T1543.001 Launch Agent
sub-techniqueEnterpriseAdversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks. Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a.plist file into the appropriate folders with the <code>RunAtLoad</code> or <code>KeepAlive</code> keys set to <code>true</code>. The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (4)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Isolate
Deceive
Restore
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlstrong · backed by 5 of 8 mapped controls
- PR.PSPlatform Securitymoderate · backed by 3 of 8 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 2 of 8 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (8)
Security controls that mitigate this.
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (2)
Threat groups associated with this.
software (22)
Malware and tools associated with this.
Detected by (Sigma) (2)
Sigma detection rules related to this.
source
Where this definition is published.