# T1543.001 - Launch Agent
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1543/001)
<blockquote>Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>$HOME/Library/LaunchAgents</code> (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).
 
Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories  (Citation: Sofacy Komplex Trojan)  (Citation: Methods of Mac Malware Persistence). The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for OS X). They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Launch Agent](#atomic-test-1---launch-agent)


<br/>

## Atomic Test #1 - Launch Agent
Create a plist and execute it

**Supported Platforms:** macOS


**auto_generated_guid:** a5983dee-bf6c-4eaf-951c-dbc1a7b90900





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| plist_filename | filename | String | com.atomicredteam.plist|
| path_malicious_plist | Name of file to store in cron folder | String | $PathToAtomicsFolder/T1543.001/src/atomicredteam_T1543_001.plist|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}
```

#### Cleanup Commands:
```bash
sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename}
sudo rm ~/Library/LaunchAgents/#{plist_filename}
```



#### Dependencies:  Run with `bash`!
##### Description: The shared library must exist on disk at specified location (#{path_malicious_plist})
##### Check Prereq Commands:
```bash
if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
echo "The shared library doesn't exist. Check the path"; exit 1;
```




<br/>
