| elastic |
Persistence via a Hidden Plist Filename via macOS Security Events |
production |
2026-10-06 |
| elastic |
Launch Item Registration with Suspicious Executable Path via macOS Security Events |
production |
2026-10-06 |
| elastic |
First Time Python Created a LaunchAgent or LaunchDaemon |
production |
2026-09-29 |
| elastic |
Suspicious Hidden Child Process of Launchd |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Persistence via Suspicious Launch Agent or Launch Daemon |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Launch Service Creation and Immediate Loading |
production |
2026-09-18 |
| sigma |
Atomic MacOS Stealer - Persistence Indicators |
experimental |
2025-11-22 |
| sigma |
Launch Agent/Daemon Execution Via Launchctl |
test |
2024-05-13 |
| sigma |
Potential Persistence Via PlistBuddy |
test |
2023-02-18 |