Home/ MITRE Matrix/ Persistence/ T1543.004

T1543.004Launch Daemon

T1543.004 — Launch Daemon is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 3 detection use cases covering it and 3 threat-intel articles citing it.

PersistencePrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

3Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1543 · Create or Modify System Process

Use cases covering this technique (3)

[LLM] MiniRAT launchctl persistence established during macOS CI build Bespoke install · hunting DSΣPCS [LLM] launchctl persistence registering zsh.profiler service from non-admin location Bespoke install · alerting DSΣPDDCS [LLM] OpenClaw persistence — launchd plist / systemd unit drop referencing 'openclaw' Bespoke install · alerting DSΣPDDCS

Articles citing this technique (3)

high Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners art-160

high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-521

crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-526