How Malware Persists on macOS: Launch Items and Other Startup Mechanisms
Summary
Huntress explains macOS persistence mechanisms, including Launch Daemons and Agents, login hooks, cron and periodic scripts. Its agent currently monitors Launch Items, which can be used by both legitimate software and malware.
Key points
- Huntress says its macOS agent currently monitors Launch Daemons and Launch Agents, with plans to add coverage for other persistence mechanisms.
- Launch Daemons run at system startup; Launch Agents run in an interactive user session and are commonly used by both legitimate software and malware.
- Other mechanisms described include login hooks, user-configured Login Items, cron jobs, periodic scripts, launchd overrides and, on macOS 12 and earlier, emond.
- The article notes that emond and its associated files are absent from macOS Ventura 13.0 onward.
- System Extensions can provide persistence but require an entitlement from Apple; the author says they have not seen them abused.
- Huntress says human review helps validate Launch Items because legitimate entries can make malicious ones harder to distinguish.
Article Details
- Topic
- macOS persistence mechanisms and Huntress's macOS agent monitoring of Launch Daemons and Launch Agents
MITRE ATT&CK
T1053.003 · CronThe article describes using cron jobs and crontabs to persist on macOS.T1543.001 · Launch AgentLaunch Agents are described as a way malware can persist on macOS.T1543.004 · Launch DaemonLaunch Daemons are described as a way malware can persist on macOS.T1546.004 · Unix Shell Configuration ModificationThe article describes macOS Login Hooks as a mechanism for running scripts at login or logout.