MacOS LaunchAgent Persistence via Bootstrap

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•2•0•4

This rule detects potential persistence attempts on macOS by monitoring 'launchctl' commands used to bootstrap LaunchAgents or modify configuration files related to Apple's software update mechanisms. It also flags file events involving the 'com.apple.softwareupdate' cache directory, which could indicate an adversary attempting to stage or replace update-related files.