Analytics BIOC Informational
✕

Uncommon Launch Daemon persistency was registered or modified

An uncommon Launch Daemon persistence mechanism was registered/modified on the system.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Create or Modify System Process (T1543) Create or Modify System Process: Launch Daemon (T1543.004)
Detector tags: Generic Persistence Analytics
Attacker's goals:

Establish persistent access to the compromised host by registering malicious code.

Investigative actions:

Analyze the persistency item and determine whether it performs any malicious or suspicious actions. Analyze the registered process and determine whether it performs any malicious or suspicious actions. Check the events generated by the process for potential malicious behavior.

Test period:
N/A (single event)
Deduplication:
1 Day
9 variations:
  • Uncommon Launch Daemon persistency was registered or modified by a security testing tool High (parent: Informational)
  • Uncommon Launch Daemon persistency was registered or modified by a tool with possible web access Low (parent: Informational) Adds Exfiltration Over C2 Channel (T1041)
  • Uncommon Launch Daemon persistency was registered or modified while using a data communication tool Low (parent: Informational) Adds Exfiltration Over C2 Channel (T1041)
  • Uncommon Launch Daemon persistency was registered or modified while using osascript Low (parent: Informational) Adds Command and Scripting Interpreter (T1059)
  • Uncommon Launch Daemon persistency was registered or modified using Plist Buddy with Run-At-Load key Low (parent: Informational)
  • Uncommon Launch Daemon persistency was registered or modified with an uncommon path containing a known vendor name Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)
  • Uncommon Launch Daemon persistency was registered or modified with an unusual persistency executable path Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)
  • Uncommon Launch Daemon persistency was registered or modified by a non validly signed process Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)
  • Uncommon Launch Daemon persistency was registered or modified by an unsigned process Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)