attack_technique: T1543.001
display_name: 'Create or Modify System Process: Launch Agent'
atomic_tests:
- name: Launch Agent
  auto_generated_guid: a5983dee-bf6c-4eaf-951c-dbc1a7b90900
  description: |
    Create a plist and execute it
  supported_platforms:
  - macos
  input_arguments:
    plist_filename:
      description: filename 
      type: String
      default: com.atomicredteam.plist
    path_malicious_plist:
      description: Name of file to store in cron folder
      type: String
      default: $PathToAtomicsFolder/T1543.001/src/atomicredteam_T1543_001.plist
  dependency_executor_name: bash
  dependencies:
  - description: |
      The shared library must exist on disk at specified location (#{path_malicious_plist})
    prereq_command: |
      if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      echo "The shared library doesn't exist. Check the path"; exit 1;
  executor:
    name: bash
    elevation_required: true
    command: |
      if [ ! -d ~/Library/LaunchAgents ]; then mkdir ~/Library/LaunchAgents; fi;
      sudo cp #{path_malicious_plist} ~/Library/LaunchAgents/#{plist_filename}
      sudo launchctl load -w ~/Library/LaunchAgents/#{plist_filename}
    cleanup_command: |
      sudo launchctl unload ~/Library/LaunchAgents/#{plist_filename}
      sudo rm ~/Library/LaunchAgents/#{plist_filename}
