macOS Launch Agent/Daemon .plist File Creation or Modification

Benjamin Zulliger@benscha

•updated Nov 18, 2025•38•5•357

Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.