Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1543.001

T1543.001Launch Agent

T1543.001 — Launch Agent is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 22 detection use cases covering it and 18 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
22Use cases
18Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1543 · Create or Modify System Process

Use cases covering this technique (22)

Suspicious PlistBuddy Usage ESCU actions · alerting P Suspicious PlistBuddy Usage via OSquery ESCU actions · alerting P Article-specific behavioural hunt — ChainDrop: Inside a Self-Propagating npm Worm Bespoke exploit · hunting DSP Article-specific behavioural hunt — Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Bespoke exploit · hunting DSP [LLM] SleeperGem Unix persistence: cron/systemd/LaunchAgent write by Ruby-descended shell Bespoke install · hunting DSΣPDDCS [LLM] Velora macOS backdoor launchctl persistence (com.apple.Terminal.profiler.plist) Bespoke install · hunting DSΣPCS [LLM] MiniRAT launchctl persistence established during macOS CI build Bespoke install · hunting DSΣPCS Article-specific behavioural hunt — [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via M Bespoke exploit · hunting DSP [LLM] easy-day-js implant artifacts dropped: protocal.cjs / NodePackages / cross-OS persistence files Bespoke install · alerting DSΣPDDCS [LLM] macOS.Gaslight LaunchAgent persistence masquerading as com.apple.system.services.activity Bespoke install · alerting DSΣPCS Article-specific behavioural hunt — A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope Bespoke exploit · hunting DSP [LLM] easy-day-js stealer persistence masquerading as Node tooling (NodePackages / LaunchAgent / systemd) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blo Bespoke exploit · hunting DSP Article-specific behavioural hunt — Nx Console VS Code Extension Compromised Bespoke exploit · hunting DSP [LLM] macOS LaunchAgent Persistence — com.user.kitty-monitor.plist (Nx Console Compromise) Bespoke install · alerting DSΣPDDCS [LLM] Mini Shai-Hulud 'gh-token-monitor' persistence daemon (LaunchAgent / systemd) Bespoke install · alerting DSΣPDDCS [LLM] macOS LaunchAgent/LaunchDaemon plist persistence pointing at Python interpreter Bespoke install · hunting DSΣPDDCS [LLM] macOS Python backdoor persistence via kitty-monitor LaunchAgent and cat.py drop Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Bespoke exploit · hunting DSP Article-specific behavioural hunt — TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromi Bespoke exploit · hunting DSP Article-specific behavioural hunt — TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack Bespoke exploit · hunting DSP Article-specific behavioural hunt — Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, ma Bespoke exploit · hunting DSP

Articles citing this technique (18)

crit ChainDrop: Inside a Self-Propagating npm Worm art-108
crit Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks art-139
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-257
high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-258
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-271
high Everybody's shipping code they can't read art-345
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
high Nx Console VS Code Extension Compromised art-419
high Why developer machines are now the number one target for supply chain attacks art-442
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577