Full Report
In this blog, we'll explore our new Mac agent, what we look for and why—and where we’re heading.
Analysis Summary
# Tool/Technique: macOS Persistence via Launch Items
## Overview
This technique involves the use of **Launch Daemons** and **Launch Agents** to ensure that malicious code remains active on a macOS system after a reboot. By placing property list (.plist) files in specific system or user directories, attackers can ensure their binaries are automatically executed by the operating system, creating a "persistent foothold."
## Technical Details
- **Type:** Technique (Persistence Mechanism)
- **Platform:** macOS
- **Capabilities:** Auto-execution at boot or user login, privilege escalation (if system-level), and stealth (by mimicking legitimate software updaters).
- **First Seen:** Longstanding architectural feature of macOS (OS X); referenced in this context January 10, 2023.
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- **T1543 - Create or Modify System Process**
- **T1543.001 - Create or Modify System Process: Launch Agent**
- **T1543.004 - Create or Modify System Process: Launch Daemon**
## Functionality
### Core Capabilities
- **Launch Daemons:** Executed at the system level via `launchd` during the boot process. They run as root and are not tied to a specific user session.
- **Launch Agents:** Executed when a specific user logs in. These operate within the context of the user session and have the same permissions as that user.
- **Binary Execution:** Both mechanisms use `.plist` files to point toward and execute Mach-O binaries or scripts.
### Advanced Features
- **SIP Bypass Attempts:** While `/System/Library/` is protected by System Integrity Protection (SIP), attackers target `/Library/LaunchDaemons/` to achieve system-level persistence without needing to modify protected Apple-signed files.
- **Masquerading:** Malware often names these files to look like legitimate services from Apple, Google, or Microsoft to evade manual inspection by administrators.
## Indicators of Compromise
- **File Names:** Look for suspicious `.plist` files in the directories listed below.
- **Behavioral Indicators:**
- Unexpected processes running as root at system startup.
- Binaries located in `/tmp/` or hidden folders being called by a Launch Agent.
- Modification of `com.apple.loginwindow.plist` (for Login Hooks).
- **Directory Locations:**
- `/Library/LaunchDaemons/` (System-wide persistence)
- `/Library/LaunchAgents/` (Persistence for all users)
- `~/Library/LaunchAgents/` (User-specific persistence)
- `/System/Library/LaunchDaemons/` (Note: Changes here usually indicate SIP compromise)
## Associated Threat Actors
- **AMOS (Atomic macOS Stealer):** Known to exploit user trust and use similar persistence/execution methods.
- **General macOS Malware:** Most macOS-specific malware (infostealers, crypto-drainers) utilizes these mechanisms due to their reliability.
## Detection Methods
- **Behavioral Detection:** Monitoring for new or modified files in the `LaunchAgents` and `LaunchDaemons` directories.
- **Signature-based detection:** Scanning the Mach-O binaries pointed to by the `.plist` files for known malicious hashes.
- **Human Analysis:** Reviewing the "Program" or "ProgramArguments" keys within `.plist` files to verify they point to legitimate, signed executables.
## Mitigation Strategies
- **Endpoint Detection & Response (EDR):** Utilize agents (like the Huntress Mac agent) specifically designed to monitor persistence locations.
- **System Integrity Protection (SIP):** Ensure SIP is enabled to protect core system directories.
- **Least Privilege:** Limit administrative rights for standard users to prevent the installation of system-level Launch Daemons.
## Related Tools/Techniques
- **Login Hooks:** An older method of persistence involving property lists in `/Library/Preferences`.
- **Login Items:** User-level applications that launch at login, managed via System Settings.
- **AppleScript/Terminal Exploitation:** Methods used to drop or install these persistence files (e.g., ClickFix scams).