Esc

Launch Agent - T1543.001

(ATT&CK® Technique)

Definition

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents. Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1543001["Launch Agent"] --> |creates| PropertyListFile["Property List File"]; class T1543001 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";
        click T1543001 href "/offensive-technique/attack/T1543.001/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";             RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | PropertyListFile["Property List File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1543001["Launch Agent"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";              FileEviction["File Eviction"] -->
          | deletes | PropertyListFile["Property List File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1543001["Launch Agent"] ;
          class FileEviction DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; FileEncryption["File Encryption"] -->
          | encrypts | PropertyListFile["Property List File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1543001["Launch Agent"] ;
          class FileEncryption DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";   FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1543001["Launch Agent"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";                                    DecoyFile["Decoy File"] -->
          | spoofs | PropertyListFile["Property List File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1543001["Launch Agent"] ;
          class DecoyFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile";                RestoreFile["Restore File"] -->
          | restores | PropertyListFile["Property List File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1543001["Launch Agent"] ;
          class RestoreFile DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; FileAnalysis["File Analysis"] -->
          | analyzes | PropertyListFile["Property List File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1543001["Launch Agent"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";                           LocalFilePermissions["Local File Permissions"] -->
          | restricts | PropertyListFile["Property List File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1543001["Launch Agent"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class PropertyListFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions";

json