macOS Stealer - LaunchAgent Persistence Installation

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•4

This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.