Launch Agent
Subtechnique · ATTACK:enterprise:T1543.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1543.001",
"title": "Launch Agent",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1543/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d10cbd34-42e3-45c0-84d2-535a09849584",
"external_id": "T1543.001",
"domain": "enterprise",
"created": "2020-01-17T16:10:58.592Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "AppleDocs Launch Agent Daemons",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "Sofacy Komplex Trojan",
"url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
},
{
"source_name": "OceanLotus for OS X",
"url": "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
},
{
"source_name": "OSX Keydnap malware",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Methods of Mac Malware Persistence",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "OSX Malware Detection",
"url": "https://papers.put.as/papers/macosx/2016/RSA_OSX_Malware.pdf"
},
{
"source_name": "Antiquated Mac Malware",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
},
{
"source_name": "OSX.Dok Malware",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
}
]
}Explicit source assertions (26)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e0a0a6-2b51-4266-ba4e-1af344f20f62
Securelist Calisto July 2018ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0be2f567-71b1-4cae-a357-25f9e2109b9c
Wiz Mini Shai-Hulud MAY 2026ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1308cf20-40b9-4163-bb68-b3f08b0f53b8
objsee mac malware 2017ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22234127-7175-4ace-a2eb-535849e81f8d
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22a54751-c1f2-498a-bae0-fa4736c86bf5
objsee mac malware 2017ATTACK:enterprise:S0235 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32b0dfd5-4909-490e-83a4-963a30b44104
Lookout Dark Caracal Jan 2018ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4065a71f-ae1b-4dfc-9825-56d2af6d589c
objsee mac malware 2017 · CheckPoint DokATTACK:enterprise:S0497 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c391d8f-4db1-43b3-857e-b8c507f27bdb
SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f8c284a-faa2-4f58-be3b-e27f6ed84423
ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a872d22-22e6-49b1-8ddd-7efc6c403ad6
TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68146568-bc1f-49b6-9477-c6c06b0fa39c
piazza launch agent mitigationATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e8b0f50-9923-4bd5-98e0-9e6f2148c256
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72df7e88-84ce-449b-ae0f-a8ceb9316964
MacKeeper Bundlore Apr 2019ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7596369c-9096-4b91-ab65-574f0bb3d21f
Sekoia ClickFake 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024ATTACK:enterprise:T1543.001 → subtechnique-of → ATTACK:enterprise:T1543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9321a544-0bde-4d6d-a197-303b70e39fc3
ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--979bd2a9-bc77-4741-bc79-0badc9e1e98c
wardle evilquest partiATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c59b652-09bc-4457-8342-949a87c1fafa
SentinelLabs reversing run-only applescripts 2021ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4be5280-5997-4326-bb2b-71fff333cdd3
Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024ATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad257565-2097-4cdc-9a52-3e54a7188f02
CoinTicker 2019ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f451a7-f3a8-4d62-a449-21af7731d369
Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d264dcda-de7e-4196-9f7b-1408f2dda366
Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1f316bc-b215-4a72-9108-7c5bd69f0454
Unit42 CookieMiner Jan 2019ATTACK:enterprise:S0277 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e230326e-186e-490e-9299-fbc000d33d0a
objsee mac malware 2017ATTACK:enterprise:S0162 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e42547e7-0bf9-4a29-b3af-f80bd0b78e38
Sofacy Komplex TrojanATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeae0ab0-541c-401f-aa7c-af674bacdc6c
Red Canary NETWIRE January 2020ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--feccb439-0a34-4224-ba12-62e11215d5a5
synack 2016 review