System Services: Launchctl (T1569.001)

Tactic: Execution · Platforms: macOS

The interactive view maps 1 detection strategy, 1 mitigation, 6 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of System Services (T1569).

Overview

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.

Explore

• Open T1569.001 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1569.001
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan