Launch Daemon
Subtechnique · ATTACK:enterprise:T1543.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1543.004",
"title": "Launch Daemon",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1543/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--573ad264-1371-4ae0-8482-d2673b719dba",
"external_id": "T1543.004",
"domain": "enterprise",
"created": "2020-01-17T19:23:15.227Z",
"modified": "2025-10-24T17:48:49.387Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "AppleDocs Launch Agent Daemons",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "LaunchDaemon Hijacking",
"url": "https://bradleyjkemp.dev/post/launchdaemon-hijacking/"
},
{
"source_name": "WireLurker",
"url": "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf"
},
{
"source_name": "launchd Keywords for plists",
"url": "https://www.real-world-systems.com/docs/launchdPlist.1.html"
},
{
"source_name": "Methods of Mac Malware Persistence",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "OSX Malware Detection",
"url": "https://papers.put.as/papers/macosx/2016/RSA_OSX_Malware.pdf"
},
{
"source_name": "sentinelone macos persist Jun 2019",
"url": "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05237661-caaa-4527-b926-55dc6367383f
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13dca3a6-ea1f-47eb-8030-18f15e309faf
Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e4118bb-715d-49b8-82e6-1eaed4a9d96a
NCSC-NL COATHANGER Feb 2024ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48c4d56e-e282-4810-b974-6a325b7d130d
ATTACK:enterprise:T1543.004 → subtechnique-of → ATTACK:enterprise:T1543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f2a8f58-9e7a-46a1-95df-c3e85e27a072
ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62aa7456-ae5e-40d5-b7e7-6831e0cca501
Mandiant 3cx UNC4736 2023ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73798ada-f5a4-4029-ac0c-39bcae68df98
wardle evilquest partiATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7398839c-3feb-4162-a3d2-dda8fc2f0375
ESET LoudMiner June 2019ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75a7d2f6-fa2c-499c-8e4f-f8d1d2735173
TrendMicro MacOS April 2018 · sentinelone apt32 macOS backdoor 2020ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9f9bef5-31f0-44bf-bba5-4c13a5eda5ac
MacKeeper Bundlore Apr 2019ATTACK:enterprise:S0497 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c592018f-2dd6-4787-b429-c25e69d6f1cd
SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce0e6abe-ebdb-45f4-a403-261587e0fa0f
trendmicro xcsset xcode project 2020ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1f919ad-05fe-45a1-836b-0e16a0e45879
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e76db224-a9a8-4a7a-8d0c-d64979087e73
ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1543.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9aa88f9-353c-4cc0-8d58-b5b4b00bfff2
CISA AppleJeus Feb 2021 · ObjectiveSee AppleJeus 2019