On macOS, launchctl is the command line interface to launchd, the service management framework. MITRE T1569.001, Launchctl, covers adversaries using it to execute commands or programs. It is an execution technique that applies to macOS.
How attackers use it
Launchctl takes subcommands on the command line, interactively, or from standard input. MITRE says adversaries use it to run commands and programs as Launch Agents or Launch Daemons. Common subcommands are launchctl load, launchctl unload and launchctl start, for example loading a property list from a LaunchAgents folder.
How to detect it
MITRE's analytic correlates changes to plist files in the LaunchAgents and LaunchDaemons directories with a following launchctl run. Executable paths in odd places such as /tmp or /Shared are highly suspicious, as is launchctl activity followed by network connections.
A read-only way to review what is configured:
ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents
launchctl list
Compare the result with your approved software list and look at each plist's program path.
How to reduce the risk
MITRE lists user account management: prevent users from installing their own launch agents or launch daemons. On managed Macs, that means standard accounts without the rights to write to system launch folders.
Quick check
Which executable locations make a launch item suspicious?
MITRE calls out paths such as /tmp and /Shared, particularly when launchctl activity is followed by network connections.
