Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UT-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as/Library/Preferences(which execute with elevated privileges) and~/Library/Preferences(which execute with a user's privileges). Adversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism. (Citation: Sofacy Komplex Trojan)Detection: File system monitoring can determine if plist files are being modified. Users should not have permission to modify these in most cases. Some software tools like "Knock Knock" can detect persistence mechanisms and point to the specific files that are being referenced. This can be helpful to see what is actually being executed.
Monitor process execution for abnormal process execution resulting from modified plist files. Monitor utilities used to modify plist files or that take a plist file as an argument, which may indicate suspicious activity.
Platforms: macOS
Data Sources: File monitoring, Process Monitoring, Process command-line parameters
Defense Bypassed: Application whitelisting, Process whitelisting, Whitelisting by file name or path
Permissions Required: User, Administrator
TODO
Supported Platforms: macOS
-
Modify a .plist in
/Library/Preferences
OR
~/Library/Preferences
-
Subsequently, follow the steps for adding and running via Launch Agent