Esc
Launchd - T1053.004

(ATT&CK® Technique)
Definition

This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1053004["Launchd"] --> |modifies| JobSchedule["Job Schedule"]; class T1053004 OffensiveTechniqueNode;
        class JobSchedule ArtifactNode; click JobSchedule href "/dao/artifact/d3f:JobSchedule";
        click T1053004 href "/offensive-technique/attack/T1053.004/"; click JobSchedule href "/dao/artifact/d3f:JobSchedule"; T1053004["Launchd"] --> |invokes| CreateProcess["Create Process"]; class T1053004 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click CreateProcess href "/dao/artifact/d3f:CreateProcess";
        click T1053004 href "/offensive-technique/attack/T1053.004/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess"; T1053004["Launchd"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053004 OffensiveTechniqueNode;
        class ScheduledJob ArtifactNode; click ScheduledJob href "/dao/artifact/d3f:ScheduledJob";
        click T1053004 href "/offensive-technique/attack/T1053.004/"; click ScheduledJob href "/dao/artifact/d3f:ScheduledJob"; T1053004["Launchd"] --> |creates| PropertyListFile["Property List File"]; class T1053004 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";
        click T1053004 href "/offensive-technique/attack/T1053.004/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";                   FileEviction["File Eviction"] -->
          | deletes | PropertyListFile["Property List File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1053004["Launchd"] ;
          class FileEviction DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction";              FileEncryption["File Encryption"] -->
          | encrypts | PropertyListFile["Property List File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1053004["Launchd"] ;
          class FileEncryption DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";            HostShutdown["Host Shutdown"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          HostShutdown["Host Shutdown"] -.->
            | may-evict | T1053004["Launchd"] ;
          class HostShutdown DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click HostShutdown href "/technique/d3f:HostShutdown"; ProcessTermination["Process Termination"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          ProcessTermination["Process Termination"] -.->
            | may-evict | T1053004["Launchd"] ;
          class ProcessTermination DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessTermination href "/technique/d3f:ProcessTermination"; ProcessSuspension["Process Suspension"] -->
          | suspends | ScheduledJob["Scheduled Job"];

          ProcessSuspension["Process Suspension"] -.->
            | may-evict | T1053004["Launchd"] ;
          class ProcessSuspension DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSuspension href "/technique/d3f:ProcessSuspension";       DecoyFile["Decoy File"] -->
          | spoofs | PropertyListFile["Property List File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1053004["Launchd"] ;
          class DecoyFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";                FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1053004["Launchd"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";              ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -.->
            | may-detect | T1053004["Launchd"] ;
          class ProcessSelf-ModificationDetection DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessSpawnAnalysis["Process Spawn Analysis"] -.->
            | may-detect | T1053004["Launchd"] ;
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | CreateProcess["Create Process"];

          SystemCallAnalysis["System Call Analysis"] -.->
            | may-detect | T1053004["Launchd"] ;
          class SystemCallAnalysis DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallAnalysis href "/technique/d3f:SystemCallAnalysis";         SystemCallFiltering["System Call Filtering"] -->
          | filters | CreateProcess["Create Process"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering"; SystemCallFiltering["System Call Filtering"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          
          class SystemCallFiltering DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering";     ExecutableAllowlisting["Executable Allowlisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableAllowlisting["Executable Allowlisting"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class ExecutableAllowlisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting"; ExecutableDenylisting["Executable Denylisting"] -->
          | filters | CreateProcess["Create Process"];

          ExecutableDenylisting["Executable Denylisting"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class ExecutableDenylisting DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | restricts | CreateProcess["Create Process"];

          
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class CreateProcess ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class Kernel-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Kernel-basedProcessIsolation href "/technique/d3f:Kernel-basedProcessIsolation"; Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | ScheduledJob["Scheduled Job"];

          Application-basedProcessIsolation["Application-based Process Isolation"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class Application-basedProcessIsolation DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click Application-basedProcessIsolation href "/technique/d3f:Application-basedProcessIsolation";             RestoreFile["Restore File"] -->
          | restores | PropertyListFile["Property List File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1053004["Launchd"] ;
          class RestoreFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; FileAnalysis["File Analysis"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1053004["Launchd"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";                           LocalFilePermissions["Local File Permissions"] -->
          | restricts | PropertyListFile["Property List File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions";              RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | PropertyListFile["Property List File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1053004["Launchd"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";              SystemDaemonMonitoring["System Daemon Monitoring"] -->
          | monitors | ScheduledJob["Scheduled Job"];

          SystemDaemonMonitoring["System Daemon Monitoring"] -.->
            | may-detect | T1053004["Launchd"] ;
          class SystemDaemonMonitoring DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click SystemDaemonMonitoring href "/technique/d3f:SystemDaemonMonitoring"; ScheduledJobAnalysis["Scheduled Job Analysis"] -->
          | analyzes | JobSchedule["Job Schedule"];

          ScheduledJobAnalysis["Scheduled Job Analysis"] -.->
            | may-detect | T1053004["Launchd"] ;
          class ScheduledJobAnalysis DefensiveTechniqueNode;
          class JobSchedule ArtifactNode;
          click ScheduledJobAnalysis href "/technique/d3f:ScheduledJobAnalysis";     ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | ScheduledJob["Scheduled Job"];

          ProcessLineageAnalysis["Process Lineage Analysis"] -.->
            | may-detect | T1053004["Launchd"] ;
          class ProcessLineageAnalysis DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis"; HostReboot["Host Reboot"] -->
          | terminates | ScheduledJob["Scheduled Job"];

          HostReboot["Host Reboot"] -.->
            | may-evict | T1053004["Launchd"] ;
          class HostReboot DefensiveTechniqueNode;
          class ScheduledJob ArtifactNode;
          click HostReboot href "/technique/d3f:HostReboot";
json