Launchctl Service Loaded via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.