Launchctl
Subtechnique · ATTACK:enterprise:T1569.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1569.001",
"title": "Launchctl",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1569/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--810aa4ad-61c9-49cb-993f-daa06199421d",
"external_id": "T1569.001",
"domain": "enterprise",
"created": "2020-03-10T18:26:56.187Z",
"modified": "2025-10-24T17:49:02.098Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Sofacy Komplex Trojan",
"url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
},
{
"source_name": "Launchctl Man",
"url": "https://ss64.com/osx/launchctl.html"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--131d75f1-84c3-4ef8-b858-7f74aa7ce157
ESET LoudMiner June 2019ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a99d32c-3f9c-4817-8103-87c7b0b60bcb
Kandji Cuckoo April 2024ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3eb174df-6b12-484e-89c1-fce208e6cdfd
CISA AppleJeus Feb 2021ATTACK:enterprise:T1569.001 → subtechnique-of → ATTACK:enterprise:T1569
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d403e65-4c96-424e-9bb9-3a2eb6d66af5
ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b164ac03-0d0b-494b-b433-7df173308019
SentinelLabs reversing run-only applescripts 2021ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b502aff3-128e-4715-a8bc-7b7b8fa0be74
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb371ea5-33c4-42e7-bcb0-3374240da553
Securelist Calisto July 2018ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1569.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2bf1135-6715-446a-aff7-96d5a0a20477