« Lateral Movement via Startup Folder Launch Service Creation and Immediate Loading »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Launch Item Registration with Suspicious Executable Path via macOS Security Events

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Launch Item Registration with Suspicious Executable Path via macOS Security Events

edit

Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • OS: macOS
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Data Source: macOS Security Events
  • Resources: Investigation Guide
  • Rule Type: ESQL
  • Platform: macOS
  • Domain: Endpoint

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Launch Item Registration with Suspicious Executable Path via macOS Security Events

On macOS, launch agents and launch daemons run a program defined in their property list (plist). When a launch item is registered, the BackgroundTaskManagement subsystem logs the plist path and the target executable path to the unified log. Legitimate persistent software almost always runs an executable from a system or application directory. An executable staged in a temporary or world-writable directory (for example /tmp, /private/tmp, /var/tmp, /Users/Shared, or /var/folders) is a strong indicator of malicious persistence. This rule alerts on launch item registrations whose executable resides in such a location, and reports the plist path, item type, and executable.

Possible investigation steps

  • Review Esql.executable and Esql.plist_path in the alert to identify the staged program and its launch item.
  • Retrieve and analyze the executable. Determine whether it is signed, what it does, and how it arrived on the host.
  • Determine how and when the plist and executable were created, and by which process, using Elastic Defend telemetry if available.
  • Review other alerts and activity for the host and associated user during the same period.

False positive analysis

  • Developer and build tooling occasionally runs helper executables from temporary or user directories.
  • Verify the executable and its origin; exclude known-good paths or signing identities if the behavior is expected.

Response and remediation

  • If the launch item is not legitimate, unload it with launchctl bootout, remove the plist, and remove or quarantine the executable.
  • Investigate the host for the initial access vector and any activity performed by the program.
  • Reset credentials for the affected user and review the host for additional compromise.
  • Escalate to the security operations team if additional hosts show similar patterns.

Setup

edit

Setup

This rule requires data from the macOS Security Events integration. Integration setup instructions: macOS Security Events

Rule query

edit
FROM logs-macos.process_execution_monitoring-* metadata _id, _version, _index
| WHERE data_stream.dataset == "macos.process_execution_monitoring" and
    macos.event.message.description LIKE "*effectiveItemDisposition*" and
    (macos.event.message.description LIKE "*url=file://*/Library/LaunchAgents/*" or
        macos.event.message.description LIKE "*url=file://*/Library/LaunchDaemons/*")
| GROK macos.event.message.description "url=file://%{DATA:Esql.plist_path}, config"
| GROK macos.event.message.description "type=%{DATA:Esql.item_type},"
| GROK macos.event.message.description "BTMConfigExecutablePath = \"%{DATA:Esql.executable}\""
| WHERE Esql.executable RLIKE "/(private/)?(tmp|var/tmp|var/folders)/.*|/Users/Shared/.*|/Users/[^/]+/(Downloads|Public|Library/Caches)/.*"
| KEEP _id, _version, _index, @timestamp, host.name, Esql.executable, Esql.plist_path, Esql.item_type, macos.event.message.description

Framework: MITRE ATT&CKTM

« Lateral Movement via Startup Folder Launch Service Creation and Immediate Loading »