# T1543.004 - Launch Daemon
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1543/004)
<blockquote>Adversaries may create or modify launch daemons to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in <code>/System/Library/LaunchDaemons</code> and <code>/Library/LaunchDaemons</code> (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). 

Adversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories  (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. 

The plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation. </blockquote>

## Atomic Tests

- [Atomic Test #1 - Launch Daemon](#atomic-test-1---launch-daemon)


<br/>

## Atomic Test #1 - Launch Daemon
Utilize LaunchDaemon to launch `Hello World`

**Supported Platforms:** macOS


**auto_generated_guid:** 03ab8df5-3a6b-4417-b6bd-bb7a5cfd74cf





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| plist_filename | filename | String | com.atomicredteam.plist|
| path_malicious_plist | Name of file to store in cron folder | String | $PathToAtomicsFolder/T1543.004/src/atomicredteam_T1543_004.plist|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
sudo cp #{path_malicious_plist} /Library/LaunchDaemons/#{plist_filename}
sudo launchctl load -w /Library/LaunchDaemons/#{plist_filename}
```

#### Cleanup Commands:
```bash
sudo launchctl unload /Library/LaunchDaemons/#{plist_filename}
sudo rm /Library/LaunchDaemons/#{plist_filename}
```



#### Dependencies:  Run with `bash`!
##### Description: The shared library must exist on disk at specified location (#{path_malicious_plist})
##### Check Prereq Commands:
```bash
if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
echo "The plist file doesn't exist. Check the path and try again."; exit 1;
```




<br/>
