macOS pslist Persistence via Launch Agent or Daemon Creation

F S@Fsdr

•updated Aug 19, 2026•8•0•12

Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.