Lion Cipher Lab
Triage macOS Launch Agent and Launch Daemon persistence from plist files
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When malware wants to survive a reboot on a Mac, the most common move is to drop one small text-like file into a LaunchAgents or LaunchDaemons folder. That file, a property list (plist), tells launchd, the program that starts everything on macOS, what to run and when. MITRE ATT&CK tracks this as T1543.001 (Launch Agent) and T1543.004 (Launch Daemon). For an investigator, those folders are the first place to look, and the work looks easy: open each file and read it. It is not quite that easy. Plists can be stored in a binary format that text tools mangle, attackers name their files after Apple…
What you'll learn
- Knowing the five launchd folders, who owns each one, and which are Apple-only
- Reading the launchd keys that decide what runs and when: Label, Program, ProgramArguments, RunAtLoad, KeepAlive, StartInterval, WatchPaths
- Parsing both XML and binary property lists with Python's plistlib
- Explaining exactly why grep finds some strings in a binary plist and misses others (ASCII vs UTF-16BE)
- Writing and scoring persistence-triage rules: writable or hidden paths, label/file mismatches, com.apple labels outside /System, inline interpreter commands, plist-newer-than-install
- Naming what a plist cannot prove, and the next check (code signature, Login Items / background task status)
Steps in this lab
- What launchd persistence is, and why the plist is the evidence
- The five folders, and who is allowed to write each one
- The keys that decide what runs, and when
- Build the evidence tree: twelve plists, four of them binary
- Look before you script: open one XML plist and one binary plist
- Triage three ways and score each one
- Why the byte search went blind on one binary plist
- Read the flags like an investigator, not a scoreboard
- What a plist cannot tell you, and the checks that can
- Optional: run the same triage on a real Mac (read-only)
- When to reach for this, and how a pro does it better