Interact with LaunchAgents and LaunchDaemons.
launchctllaunchctlSandbox: execFile · Timeout: 30s
security.execution.command security.persistence.hook Use launchctl to execute an application: A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.
sudo launchctl load /Library/LaunchAgent/com.apple.installerPersistent launch agent: Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist
launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist| Type | Rule / Indicator |
|---|---|
| other | LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications. |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events Jamf Protect: Detect launchctl activity that unloads or bootsout specific service |
launchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.