Forensia CTI Core

About

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the <code>RunAtLoad</code> or <code>KeepAlive</code> keys set to <code>true</code>. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.

Platforms: macOSParent: T1543 Create or Modify System ProcessMITRE ATT&CK ↗

Used by actors

1 known groups

G1052 Contagious Interview

Software

21 malware/tools implement this

KomplexNETWIRECrossRATCalistoKeydnapFruitFlyProtonDokMacSpyOSX_OCEANLOTUS.DCoinTickerBundloreCookieMinerDaclsThiefQuestGreen LambertMacMamacOS.OSAMinerCuckoo StealerInvisibleFerretGlassWorm

Corpus indicators tagged with this technique

78 indicators in the corpus carry T1543.001.

Indicator	Type	Family	Sev	Src
ffd773f157df70291f0910a45a1d8d9a	hash	—	80	1
134517796178a150a1585672be134169d6877082b598d840baa3f37b0222be26	hash	—	80	1
b4aa7255af4b016586090a5b451300fa	hash	—	80	1
fc091ddb4d845280aeb7745cfdb6b7cb0013abc35db9e634f055b8e8fb0b5b1e	hash	—	80	1
baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239	sha256	prompt_injection	80	2
b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394	sha256	prompt_injection	80	2
6c3f61d46d4de26b9cb16808bf17c33ae69f651a4b879e7b5612ff7f548e2a82	hash	—	80	1
a247a63644c3475f436d076f55523ea39afd8c41	hash	—	80	1
c40126fea6ed24652a3e4e19205075cb02cca3e2	hash	—	80	1
f544bfab72d380cc20692d8ec9d31ea666785fe225dccd55beab29a3c0fdfad2	hash	—	80	1
77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca	sha256	prompt_injection	80	2
d15248555e7a2d9c279d219e6587a74fca9c25720194512a2e4b0757f7a63219	sha256	—	80	1
ac14d191300c2d3aa9f57829b895b7720be1ef3563bace25de731002d52577f7	sha256	—	80	1
605169623267c4eb73693b22b811dc7a	hash	—	80	1
5144bf4e32c5832c426ad3da55d45f026f66bc95	hash	—	80	2
638b0a77a6d686849a78b500adf5e565	hash	—	80	1
8bfa2df2110c38dff2359a416ce14693	hash	—	80	2
a2421f7fd4be6b12382150033507af7aa8bf6241	hash	—	80	2
bb1e6e2650d3d77d732c5eb5176011f914dd87df	hash	—	80	1
bf90fb31e6024d7e6616f5acd0e8aa28738a9095a508c1a986e1e974cb9e79a0	hash	—	80	1
cc4f048e66c5ab3c0f1d767bb8fc464d082641f4888ea3cd14ea3775077c4bf2	hash	—	80	1
cdec8b20338beb708b5be8d3d7a3041a35a8b0fb92f9186262f312d55ff82066	hash	supply_chain	80	1
32da1437a2734224406c7e5e8d756f0c0cd58c0c959478571cbfc0cd564d018a	hash	—	80	1
9570f77a5e1511869f4e554e7166df9fde081f2583e293c2569621792ed7d9c9	hash	supply_chain	80	1
c38954e85bf5433e61e7c8f4230336695624ae88b6953afabf7bf817aa91b638	hash	supply_chain	80	1
6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525	sha256	prompt_injection	80	2
22d051c9cc458012b98e9bdca501759e	hash	—	80	2
2c5bc9e95e1e9b73e3ba8870a008802899866a2c0e2e10112aefddf7a96af04e	hash	—	80	1
dbe028a59ffe936bce9acb56e9c2db93ef6f84fe	sha1	—	78	1
5555494492fc075f441637fb9d894913dde3a2ea	sha1	prompt_injection	78	2

Showing the top 30 by severity of 78.