Plist File Modification (T1647) is a Defense Impairment technique on macOS. Adversaries edit property list (plist) files to enable other malicious activity and to evade or bypass system defenses.
macOS apps keep settings in plist files such as Info.plist. They are structured key and value data in XML format, saved as text or binary, and they tell the operating system how to handle an app at runtime.
How attackers use it
MITRE says adversaries can change keys to influence behavior: hiding an app's execution (Hidden Window) or running extra commands for persistence, for example through Launch Agent, Launch Daemon or Re-opened Applications.
Examples from the page:
- Adding a malicious app path to the Dock settings in ~/Library/Preferences/com.apple.dock.plist.
- Changing the LSUIElement key in an application's Info.plist to run it in the background.
- Inserting environment variables with LSEnvironment to enable persistence through Dynamic Linker Hijacking.
Cuckoo Stealer can create and populate plist files to enable execution. XCSSET has used the plutil command to modify LSUIElement, DFBundleDisplayName and CFBundleIdentifier in an Info.plist, and in later versions used a third party notarized dockutil tool to alter the plist that controls what appears in the Dock and Launchpad.
How to detect it
MITRE suggests monitoring for unexpected changes to plist files in persistence and configuration directories such as ~/Library/LaunchAgents, ~/Library/Preferences and /Library/LaunchDaemons, particularly when a change is followed by a new or unexpected binary running. Track the use of the defaults and plutil utilities, and of text editors, that change Info.plist files. Correlate file changes with process launches or service starts that reference the altered plist.
How to reduce the risk
The one mitigation MITRE lists is Application Developer Guidance: make sure applications follow Apple's developer guidance that enables the hardened runtime. In addition, use endpoint management to watch the LaunchAgents and LaunchDaemons folders on managed Macs.
Check your own environment
Read-only (macOS Terminal):
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
defaults read com.apple.dock persistent-apps
Review anything you do not recognize. To read a specific plist as text, use plutil with the print option and the file path.
Quick check
Which key can make an app run in the background?
LSUIElement in the app's Info.plist, per MITRE.
