Sapphire Sleet - Plist LaunchAgent Persistence (T1543.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies the payload establishing reboot persistence by writing a .plist to the user's ~/Library/LaunchAgents directory and activating it using 'launchctl load'.