LaunchDaemon persistence as root

§ Context

Assumed environment: attacker has root on macOS (via sudo, kernel exploit, etc.). The target has not deployed an EDR that catches new LaunchDaemons.

§ Steps

1. 01
   Verify across rebootInitial Access

   T1078— Valid Accounts
2. 02
   Root shellInitial Access

   T1078— Valid Accounts
3. 03
   launchctl load + RunAtLoad=truePersistence

   T1547— Boot or Logon Autostart Execution
4. 04
   Hide plist via legitimate-looking nameDefense Evasion

   T1027— Obfuscated Files or Information
5. 05
   Write /Library/LaunchDaemons/<plist>Persistence

   MAC-LAUNCHAGENT— LaunchAgent / LaunchDaemon Persistence

§ References

• T1078Valid Accounts
• T1547Boot or Logon Autostart Execution
• T1027Obfuscated Files or Information

§ Frequently asked

What is the "LaunchDaemon persistence as root" attack path?

Once at root (via sudo or a local-exploit), drop a .plist into /Library/LaunchDaemons that re-implants on every boot — survives user logout and full power-cycle. It chains 5 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Verify across reboot (T1078) — a initial access primitive. Assumed environment: attacker has root on macOS (via sudo, kernel exploit, etc.

What is the final impact of this kill-chain?

The final step lands on Write /Library/LaunchDaemons/<plist> (MAC-LAUNCHAGENT), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  LogoFAIL → UEFI bootkit → persistent ring-0

  Drop a malformed JPG/PNG/BMP into the EFI partition's boot logo path. Vulnerable vendor UEFI parses it pre-OS, executes attacker code before SecureBoot's verifier — install a bootkit that survives wipe + reinstall.

• Shared techniques2

  Process doppelgänging → spawn signed image with attacker bytes

  Use NTFS transactional file APIs to overlay an attacker image during process creation. The final mapped process differs from the on-disk file — AV sees only the legit signed image at scan time.

• Shared techniques2

  Cross-chain bridge validator-set bypass → mint wrapped tokens

  Bridge's signature-set check is off-by-one (Nomad-class) or accepts a zero address (Ronin-class). Mint wrapped tokens on the destination chain without locking on the source.