System Services: Launchctl T1569.001

Tactic: Execution

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
ESFexecProcess Execution
ESFforkProcess Fork

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine3contains 3, ends_with 1 &, .amazonaws.com, .cloudfront.net, event1.file.name, http
EventType3eq 3, in 1, ne 1exec, deletion, fork, launch_daemon
process.args3eq 3, starts_with 1, wildcard 1*/bin/base64*-d*, */bin/chmod +x*, */bin/curl*.amazonaws.com*, -l, load
process_name3eq 3, in 2launchctl, base64, bash, chmod, curl
event.type2eq 1, in 1start, process_started
Image1ends_with 1/launchctl
host.os.type1eq 1
process_guid1eq 1event0.process.entity_id

Top indicator values (63 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
exec
2579
EventTypeeq
launch_daemon
15
process_nameeq
launchctl
26
process_namein
curl
290
process_namein
nscurl
241
CommandLinecontains
.amazonaws.com
1
CommandLinecontains
.cloudfront.net
1
CommandLinecontains
event1.file.name
1
CommandLinecontains
http
152
CommandLinecontains
load
1
CommandLinecontains
raw.githubusercontent.com
1
CommandLinecontains
start
113
CommandLinecontains
submit
1
CommandLineends_with
&
1
EventTypein
exec
1206
EventTypein
fork
17
EventTypene
deletion
187
Imageends_with
/launchctl
12
event.typeeq
start
11087
event.typein
process_started
139
event.typein
start
141
process.argseq
+x
14
process.argseq
-?d
12
process.argseq
-?w
12
process.argseq
-base64
12
process.argseq
-c
1107
process.argseq
-d
112
process.argseq
-enc
12
process.argseq
-l
117
process.argseq
-w
12

Exclusions (21 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
ParentImagewildcard
/applications/epson software/epson software updater.app/contents/macos/epson...
1
ParentImagewildcard
/library/privilegedhelpertools/*
1
ParentImagewildcard
/private/var/folders/*/download/armdchammer
1
ParentImagewildcard
/sbin/launchd
1
ParentImagewildcard
/users/*/library/caches/*
1
ParentImagewildcard
/usr/local/ltechagent/ltupdate
1
process.Ext.effective_parent.executablein
/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON...
1
process.Ext.effective_parent.executablein
/Library/Application...
1
process.Ext.effective_parent.executablein
/Library/Application...
1
process.Ext.effective_parent.executablein
/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon
1
process.Ext.effective_parent.executablein
/Volumes/Fiery Software Manager/Fiery Software...
1
process.Ext.effective_parent.executablein
/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer
1
process.Ext.effective_parent.executablein
/usr/local/jamf/bin/jamf
1
process.argswildcard
./Epson Event Manager.pkg
1
process.argswildcard
./Epson Scanner ICA Driver.pkg
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Sigma 1 rule

Elastic 3 rules