# T1569.001 - Launchctl
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1569/001)
<blockquote>Adversaries may abuse launchctl to execute commands or programs. Launchctl controls the macOS launchd process, which handles things like [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)

By loading or reloading [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, adversaries can install persistence or execute changes they made.(Citation: Sofacy Komplex Trojan)

Running a command from launchctl is as simple as <code>launchctl submit -l <labelName> -- /Path/to/thing/to/execute "arg" "arg" "arg"</code>. Adversaries can abuse this functionality to execute code or even bypass application control if launchctl is an allowed process.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Launchctl](#atomic-test-1---launchctl)


<br/>

## Atomic Test #1 - Launchctl
Utilize launchctl

**Supported Platforms:** macOS


**auto_generated_guid:** 6fb61988-724e-4755-a595-07743749d4e2





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| executable_path | Path of the executable to run. | Path | /System/Applications/Calculator.app/Contents/MacOS/Calculator|
| label_name | Path of the executable to run. | String | evil|


#### Attack Commands: Run with `bash`! 


```bash
launchctl submit -l #{label_name} -- #{executable_path}
```

#### Cleanup Commands:
```bash
launchctl remove #{label_name}
```





<br/>
