Elastic medium stable eql

Creation of Hidden Launch Agent or Daemon

Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login.

View Source

Detection Logic

file where host.os.type == "macos" and event.action == "launch_daemon" and
  Persistence.name : ".*"

Field Validations

Loading…

Comments (0)

Loading comments...