Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the use of launchctl submit to establish persistence on macOS.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
