macOS Persistence via Suspicious LaunchAgent Plist Creation
Detects creation of a macOS LaunchAgent plist referencing a suspicious temp path or unrecognized vendor bundle identifier, consistent with the botking implant's macOS persistence mechanism.
Sigma
