Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1547.011

Plist Modification

PersistencePrivilege Escalation deprecated 3 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Persistence via a Hidden Plist Filename via macOS Security Events production 2026-10-06
elastic Persistence via a Hidden Plist Filename production 2026-09-18
elastic Persistence via Suspicious Launch Agent or Launch Daemon production 2026-09-18