Suspicious launchctl submit Persistence on macOS
Detects the use of launchctl submit to establish persistence on macOS. Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl submit registers a job directly via the command line without creating a plist file on disk, making it harder to discover through filesystem sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist AUDIOFIX and MINIRAT payloads with job labels like chrome.job and coreaudio.job, but the technique itself is rare in legitimate software. The rule catches any launchctl submit invocation and flags known JINX-0164 job labels for high-confidence triage.
Sigma
