CRPx0 macOS LaunchDaemon/LaunchAgent Plist Persistence

Ibrahim Saud@tektrix

•updated Sep 14, 2026•0•0•0

Detects the creation of property list (.plist) files within /Library/LaunchDaemons/ or /Library/LaunchAgents/ directories, which is a common persistence mechanism for macOS malware, including cross-platform ransomware variants like CRPx0. The rule filters out events initiated by the system installer process to reduce noise.