System

Launch Agents and Daemons

Overview

launchd is the macOS service management framework responsible for starting, stopping, and managing daemons and agents. Launch Agents and Launch Daemons are the primary persistence mechanism on macOS and are frequently abused by malware and threat actors.

This article is under development. Detailed launchd forensic analysis documentation is coming soon.

Key Forensic Areas

  • Persistence: Identify malicious Launch Agents/Daemons installed for persistence
  • Execution context: Determine whether items run as root (daemons) or user (agents)
  • Scheduling: RunAtLoad, StartInterval, StartCalendarInterval, WatchPaths triggers
  • Program arguments: Full command lines and environment variables
  • Overrides: Disabled state tracking in launchd overrides database

File Locations

DirectoryScopeDescription
/System/Library/LaunchDaemons/SystemApple system daemons
/System/Library/LaunchAgents/SystemApple system agents
/Library/LaunchDaemons/GlobalThird-party daemons (root)
/Library/LaunchAgents/GlobalThird-party agents (all users)
~/Library/LaunchAgents/UserPer-user agents
/var/db/com.apple.xpc.launchd/SystemLaunchd state database

Plist Structure

Key fields in Launch Agent/Daemon property lists:

KeyTypeDescription
LabelStringUnique service identifier
ProgramStringExecutable path
ProgramArgumentsArrayCommand and arguments
RunAtLoadBooleanExecute on load (login/boot)
KeepAliveBoolean/DictRestart policy
StartIntervalIntegerRun every N seconds
WatchPathsArrayTrigger on path changes
EnvironmentVariablesDictEnvironment variables

References

Previous
Keychain