Non-Standard MacOS Launchd Entry

Aaron Mog@AaronMogS2S

•updated Jul 2, 2025•1•3•40

Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.