Launchd Overrides
Overview
Section titled “Overview”Evidence: Launchd Overrides
Description: Collect override keys for LaunchDaemons and Agents
Category: System
Platform: macos
Short Name: launchdo
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Launchd overrides adjust behavior of daemons and agents without modifying the original plist. This data is essential for detecting persistence and unexpected service behavior.
Data Collected
Section titled “Data Collected”This collector gathers structured data about launchd overrides.
Launchd Overrides Data
Section titled “Launchd Overrides Data”| Field | Description | Example |
|---|---|---|
Name | Name | Example value |
Path | Path | Example value |
Label | Label | Example value |
Program | Program | Example value |
RunAtLoad | Run At Load | Example value |
KeepAlive | Keep Alive | Example value |
OnDemand | On Demand | Example value |
Disabled | Disabled | Example value |
UserName | User Name | Example value |
GroupName | Group Name | Example value |
StdoutPath | Stdout Path | Example value |
StderrPath | Stderr Path | Example value |
StartInterval | Start Interval | Example value |
Arguments | Arguments | Example value |
WatchPaths | Watch Paths | Example value |
QueueDirs | Queue Dirs | Example value |
InetdCompatibility | Inetd Compatibility | Example value |
StartOnMount | Start On Mount | Example value |
RootDir | Root Dir | Example value |
Cwd | Cwd | Example value |
ProcessType | Process Type | Example value |
Ctime | Ctime | 123 |
Atime | Atime | 123 |
Mtime | Mtime | 123 |
Hash | Hash | Example value |
SizeInBytes | Size In Bytes | 123 |
LastChangeTime | Last Change Time | 2023-10-15 14:30:25+03:00 |
AccessTime | Access Time | 2023-10-15 14:30:25+03:00 |
ModificationTime | Modification Time | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”This collector queries the launchd_overrides table via osquery and records results into the launchd_overrides table.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals overridden settings that may disable or enable services to aid attacker persistence or evasion.