← Back to Explore
T1569.001
Launchctl
Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands incl...
macOS
2
Detections
2
Sources
0
Threat Actors
BY SOURCE
1elastic1sigma
PROCEDURES (1)
Process Creation Monitoring2 detections
Auto-extracted: 2 detections for process creation monitoring