Launch Agent abuse (MITRE ATT&CK T1543.001) is a macOS persistence and privilege escalation technique. A Launch Agent is a per-user background job defined in a property list (plist) file and managed by launchd.
Legitimate software uses them often. MITRE notes Launch Agents are commonly installed to update programs, launch user-chosen programs at login or run developer tasks. That ordinary use is what makes malicious ones easy to overlook.
How attackers use it
When a user logs in, a per-user launchd process starts and loads each launch-on-demand agent from plist files in three places: /System/Library/LaunchAgents, /Library/LaunchAgents and ~/Library/LaunchAgents. The plist uses the Label, ProgramArguments and RunAtLoad keys to give the agent a name, an executable location and a run time.
MITRE describes adversaries placing a new plist in one of those folders with RunAtLoad or KeepAlive set to true, so the agent starts at login and restarts if it stops. The name may be disguised by copying one from the operating system or from benign software. Agents can also be started with the launchctl command (T1569.001).
Two details limit the blast radius. Launch Agents are created with user level privileges and run with user level permissions. The user folder needs no administrator rights to write to, which is why it matters for detection.
How to detect it
MITRE's detection strategy focuses on the plist files and what runs after them:
- Creation or modification of user level Launch Agent plists in the monitored directories, particularly with unusual
ProgramArgumentsorRunAtLoadvalues. - File writes correlated with execution of
launchctl. - Unsigned binaries invoked at login.
Start by knowing your normal. Collect file events for the three agent folders and keep a short allowlist of vendors that install agents on your fleet. A new plist that is not on the list, pointing at a binary in a user writable path, is a good first alert.
How to reduce the risk
MITRE lists one mitigation: restrict file and directory permissions. It suggests using group policy settings to restrict file permissions on the user LaunchAgents folder.
Beyond that, apply least privilege on endpoints so unmanaged software cannot be installed freely, and keep a baseline of the agents that should exist.
Check your own environment
Read-only commands on macOS:
ls -la /Library/LaunchAgents ~/Library/LaunchAgents
launchctl list
plutil -p ~/Library/LaunchAgents/example.plist
Replace the plist name with a file from your listing. For each agent, ask four questions:
- Which application installed it?
- Does the
ProgramArgumentspath point to a signed binary in an expected location? - Does it set
RunAtLoadorKeepAlive, and does it need to? - Does the name copy an Apple or vendor label without matching a real product?
Quick check
Which two plist keys make a Launch Agent start at login and stay running?
RunAtLoad starts it at login, and KeepAlive keeps it running. MITRE notes adversaries set one or both to true.
Does a Launch Agent run with administrator rights?
No. Launch Agents are created with user level privileges and execute with user level permissions. System wide, elevated persistence is the Launch Daemon case.
