macOS persistence via LaunchAgent plist creation

Emiliano Mema@Nosalva

•updated Aug 21, 2026•2•0•11

Detects the creation, modification, or renaming of .plist files within the /Library/LaunchAgents/ directory on macOS. This directory is a common location used by adversaries to establish persistence, as files placed here are automatically loaded and executed by the system upon user login.