macOS.Gaslight LaunchAgent persistence via plist drop to ~/Library/LaunchAgents

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.