← LibraryTechnique entry
MAC-LAUNCHAGENTPersistence
LaunchAgent / LaunchDaemon Persistence
Drop a .plist in ~/Library/LaunchAgents or /Library/LaunchDaemons referencing your binary — fires on every login / boot.
§ Where this technique fits
MAC-LAUNCHAGENT is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 2 approved dossiers in the registry, typically at step 3.5 on average.
§ Dossiers chaining this technique
- step 2 / 5
LaunchDaemon persistence as root
Once at root (via sudo or a local-exploit), drop a .plist into /Library/LaunchDaemons that re-implants on every boot — survives user logout and full power-cycle.
- step 5 / 5
Gatekeeper bypass → unsigned binary execution
Deliver a payload that strips the com.apple.quarantine xattr (via .dmg with no quarantine attribute or an archive format that doesn't preserve xattrs) — Gatekeeper never prompts.
§ What commonly comes next
- 01Boot or Logon Autostart Executionseen 1×T1547 · Persistence