Full Report
In this month’s Tradecraft Tuesday, we talked about how threat actors are finetuning their macOS malware in order to maintain persistent access and avoid detection by Apple’s security features.
Analysis Summary
# Tool/Technique: macOS Persistence via Cron Jobs and Legacy Vectors
## Overview
As Apple strengthens its native security features (such as Background Task Management - BTM), threat actors are reverting to legacy techniques and non-standard persistence mechanisms to maintain access on macOS. The primary goal is to bypass BTM notifications and Gatekeeper restrictions to execute malicious code across reboots or user sessions.
## Technical Details
- **Type:** Technique (Persistence) / Malware Family (Adload, LightSpy)
- **Platform:** macOS
- **Capabilities:** Persistence, detection evasion, automated task scheduling, TCC (Transparency, Consent, and Control) bypass.
- **First Seen:** Various (Adload is a long-standing family; increased cron usage noted in April 2025 reporting).
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1053.003 - Scheduled Task/Job: Cron]**
- **[T1543.001 - Create or Modify System Process: Launch Agent]**
- **[T1543.004 - Create or Modify System Process: Launch Daemon]**
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]** (Bypassing BTM/Gatekeeper)
- **[T1553.001 - Subvert Trust Controls: Gatekeeper Bypass]**
## Functionality
### Core Capabilities
- **Cron Job Persistence:** Utilizing `cron` to schedule malicious commands. This is often overlooked by newer macOS security frameworks like BTM, which primarily focus on Launch Items.
- **Launch Items (Plist):** Creating Launch Daemons (system-level) and Launch Agents (user-level) to ensure code executes upon boot or login.
- **Property List (plist) Modification:** Configuring `.plist` files to point to malicious binaries.
### Advanced Features
- **BTM Evasion:** Specifically crafting persistence to avoid triggering the Background Task Management database notifications that alert users to new startup items.
- **User-Interacted Persistence:** Replacing legitimate application icons (like the Dock icon) with malicious wrappers. While not a traditional "boot" persistence, it leverages user behavior to ensure re-execution.
- **TCC Framework Manipulation:** Techniques designed to skirt the "Transparency, Consent, and Control" prompts to access protected data (Camera, Microphone, Files) without explicit user approval.
## Indicators of Compromise
- **File Names:**
- Malicious `.plist` files in `/Library/LaunchDaemons/`, `/Library/LaunchAgents/`, or `~/Library/LaunchAgents/`.
- Unexpected crontab entries.
- **Behavioral Indicators:**
- `eslogger` events showing unauthorized modifications to the BTM database.
- Process spawning from `cron` or `launchd` pointing to unsigned or ad-hoc signed binaries in hidden directories (e.g., `/private/var/tmp/` or hidden folders in `~/Library/`).
- Unexpected modifications to `com.apple.dock.plist`.
## Associated Threat Actors
- **Adload:** Known for using cron jobs and Launch Agents to maintain a presence for adware/bundleware.
- **LightSpy:** A sophisticated spyware variant targeting macOS users.
- **LockBit:** Reported to have developed macOS-specific ransomware variants.
## Detection Methods
- **Behavioral Detection:** Monitoring Endpoint Security (ES) events for `ES_EVENT_TYPE_NOTIFY_SETTASK` and modifications to persistence directories.
- **BTM Database Monitoring:** Auditing the Background Task Management database for changes that did not trigger a user notification.
- **Crontab Auditing:** Regularly checking `crontab -l` for all users, including the root user, to identify unauthorized scheduled tasks.
- **YARA Rules:** Scanning for suspicious Plist keys (e.g., `RunAtLoad`, `KeepAlive`) associated with unsigned binaries.
## Mitigation Strategies
- **Endpoint Detection and Response (EDR):** Utilize tools that hook into the macOS Endpoint Security Framework (ESF) to monitor for persistence creation.
- **MDM Configuration:** Use Mobile Device Management to enforce strict Gatekeeper settings and restrict the execution of unsigned code.
- **Principle of Least Privilege:** Limit administrative rights to prevent the creation of System-level Launch Daemons.
- **System Hardening:** Regularly audit the `~/Library/LaunchAgents` and `/Library/LaunchDaemons` directories for unrecognized files.
## Related Tools/Techniques
- **XProtect & XProtect Remediator:** Apple's native malware scanning tools.
- **Gatekeeper:** The macOS feature that verifies app signatures and notarization.
- **Background Task Management (BTM):** The framework introduced in macOS Ventura to track persistent items.