Created by Josh Carullo
launchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.
|2023-05-27||Execution Persistence||bash zsh oneliner|
Use launchctl to execute an application
A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.
sudo launchctl load /Library/LaunchAgent/com.apple.installer
- LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist’s with executables located in /tmp or /Shared could identify suspicious applications.