Launch Agent/Daemon Execution Via Launchctl

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•24

Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.