Persistence Mechanisms

Overview

Persistence mechanisms are the primary technique attackers use to survive reboots and re-establish access on a compromised macOS host. Enumerating every persistence vector — and detecting unsigned, suspicious, or recently-modified entries — is foundational to incident response.

Analysis Tips

• Modification time correlation: Match persistence entry mtime with other artifacts (FSEvents, Unified Logs) to identify install timing
• Code signing: Verify signature on the executable referenced by Program / ProgramArguments — unsigned binaries in user-writable paths are a strong signal
• Background Task Management (BTM): macOS 13+ consolidated persistence into BackgroundItems-v*.btm under /private/var/db/com.apple.backgroundtaskmanagement/. Review Bypass flags and recently-added items
• LaunchAgent vs LaunchDaemon: Daemons run as root, agents as the logged-in user. Daemons in user-writable locations are unusual
• Cron and periodic: Less common on modern macOS but still used by attackers — easy to miss
• Other vectors: macfor also collects at jobs, shell startup files, launchd overrides, login/logout hooks, kernel and system extensions, authorization plugins, configuration profiles, emond rules, and StartupItems

Related Artifacts

• FSEvents - Confirm install timing of persistence files
• Unified Logs - launchd subsystem logs daemon load events
• Quarantine Events - Originating download for the persistence binary

References

• Apple Daemons and Services
• BlockBlock and Objective-See research on macOS persistence