216.73.217.22

T1053.004: Launchd

View on MITRE ATT&CK The MITRE Corporation · Published 16/12/2025 19:38 · Modified 27/03/2026 01:11

Essential information

MITRE technique ID
T1053.004
Confidence
100/100
Revoked
No
Published
16/12/2025 19:38
Modified
27/03/2026 01:11
Author / Source
The MITRE Corporation

Aliases

T1053.004

Platforms

macos

Description

This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. Adversaries may abuse the `Launchd` daemon to perform task scheduling for initial or recurring execution of malicious code. The `launchd` daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in `/System/Library/LaunchDaemons` and `/Library/LaunchDaemons` (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). An adversary may use the `launchd` daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. `launchd` can also be abused to run a process under the context of a specified account. Daemons, such as `launchd`, run with the permissions of the root user account, and will operate regardless of which user account is logged in.

Kill chain phases

Kill chainPhase
mitre-attack execution
mitre-attack persistence
mitre-attack privilege-escalation

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references