Launch agent persistence

persistence_launch_agent

Writes a launch agent plist into the current user's LaunchAgents directory, loads it with launchctl, then unloads and deletes it. The agent would only run /usr/bin/true. This is the standard macOS persistence mechanism.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 1 macOS

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1543.001	Launch Agent	Persistence	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other persistence tests

Other tests in the Persistence category.
Test	What it does	Severity
WMI event subscription persistence persistence_wmi_subscription	Creates a permanent WMI event filter, a command-line consumer bound to it, and the binding between them — the fileless persistence mechanism that surv…	high
Cron persistence persistence_cron_entry	Adds a no-op entry to the current user's crontab and removes it again. The existing crontab is backed up into the sandbox before the change and restor…	medium
Autorun registry key write and revert persistence_run_key	Writes an inert autorun value under HKCU ...\CurrentVersion\Run, verifies it, then deletes it again. The value only runs cmd.exe /c exit, and it is re…	medium
Scheduled task persistence persistence_scheduled_task	Registers a scheduled task that would run a no-op command at logon, verifies it exists, then deletes it. Scheduled tasks are the most common persisten…	medium
Shell profile persistence persistence_shell_profile	Appends a commented no-op line to the current user's shell profile and then restores the file from a byte-for-byte backup taken beforehand. Shell prof…	medium
Startup folder persistence persistence_startup_folder	Drops a no-op command file into the current user's Startup folder, confirms it is there, and deletes it again. This is the oldest autostart mechanism …	medium
systemd user unit persistence persistence_systemd_user_unit	Installs a systemd user service that would run /usr/bin/true, enables it, then disables and deletes it. A user unit needs no root at all, which is wha…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.