CatalogLOOBins

ORCHARD · Tool

launchctl

2 techniquesmacOSLOOBinsGPL-3.0

Use launchctl to execute an application

ExecutionPersistencemacOS

A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.

sudo launchctl load /Library/LaunchAgent/com.apple.installer
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Execution, Persistence
Detection
LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.: LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.
Jamf Protect: Detect launchctl activity that unloads or bootsout specific service: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events

Persistent launch agent

PersistencemacOS

Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist

launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Persistence
Detection
LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.: LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.
Jamf Protect: Detect launchctl activity that unloads or bootsout specific service: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events