Home/ MITRE Matrix/ Persistence/ T1543.004

T1543.004Launch Daemon

T1543.004 — Launch Daemon is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 2 detection use cases covering it and 2 threat-intel articles citing it.

PersistencePrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

2Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1543 · Create or Modify System Process

Use cases covering this technique (2)

[LLM] launchctl persistence registering zsh.profiler service from non-admin location Bespoke install · alerting DSΣPDDCS [LLM] OpenClaw persistence — launchd plist / systemd unit drop referencing 'openclaw' Bespoke install · alerting DSΣPDDCS

Articles citing this technique (2)

high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-399

crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-404