Potential Persistence Via PlistBuddy

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•29

This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.