macOS persistence via SMAppService registration and new LaunchAgent plist
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
Microsoft Sentinel (KQL)
