macOS LaunchAgent Persistence via Suspicious Plist Creation and launchctl Load

Ethan Andrews@eandrews

•updated Jul 24, 2026•5•0•39

Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.