# launchctl

> Interact with LaunchAgents and LaunchDaemons.

launchctl can be used to load, start, stop, and unload macOS services. It is a command-line frontend to launchd.

- Page: https://loobins.io/binaries/launchctl/
- Author: Josh Carullo
- Created: 2023-05-27
- Tactics: Execution, Persistence

## Paths

- `/bin/launchctl`

## Example Use Cases

### Use launchctl to execute an application

A oneliner that will load a plist as a LaunchAgent or LaunchDaemon, achieving persistence on a target machine. This command requires root privileges.

```bash
sudo launchctl load /Library/LaunchAgent/com.apple.installer
```

- Tactics: Execution, Persistence
- Tags: bash, zsh, oneliner

### Persistent launch agent

Creation of a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist

```bash
launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist
```

- Tactics: Persistence

## Detections

- LaunchAgents and LaunchDaemons must have a plist file on disk in the root, system, or user Library directory. Monitoring for plist's with executables located in /tmp or /Shared could identify suspicious applications.
- [Jamf Protect: Detect launchctl activity that unloads or bootsout specific service](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/launchctl_unload_and_bootout_events)

## Resources

- [20 Common Tools & Techniques used by macOS threat Actors & Malware](https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/)
- [Mitre Attack Technique: launchctl T1569](https://attack.mitre.org/techniques/T1569/001/)
- [MITRE ATT&CK T1543.001  Create or Modify System Process: Launch Agent ](https://attack.mitre.org/techniques/T1543/001/)
- [Komplex OS X Trojan (Sofacy)](https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/)