Persistence via LaunchAgent masquerading as com.apple.crashreporter.helper

Duo Tech@duotech

•updated Jul 14, 2026•4•0•6

Detects the creation or modification of a file at a specific Launch Agent path commonly used for macOS persistence. Attackers often place property list (.plist) files in /Library/LaunchAgents/ to achieve persistence across system reboots or user logons.