macOS Launch Agent Plist Deployed via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the deployment of a macOS Launch Agent Property List (plist) file via HTTP. It specifically looks for HTTP responses (flow:to_client) containing both ".plist" in the URI and "LaunchAgent" within the file data, indicating a potential persistence mechanism being established on a macOS system.