LaunchAgent persistence via com.apple.crashreporter.helper.plist

Duo Tech@duotech

•updated Jul 14, 2026•3•0•4

Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.