Living off the Land on macOS: Detecting Osascript, Launchctl, and Plutil Abuse

Living-off-the-land tactics on macOS (LOOBins) exploit native utilities included with macOS to conduct reconnaissance, bypass security prompts, and establish persistence. Utilities such as osascript, launchctl, and plutil are pre-installed, signed by Apple, and expected in standard operating system operation. Threat actors exploit these characteristics to operate without deploying unverified binaries.

Understanding how these tools execute and what telemetry they produce enables detection engineers to differentiate routine system configuration from malicious activity.

Osascript abuse for TCC credential harvesting

Osascript executes AppleScript and JavaScript for Automation (JXA) scripts from the command line. Threat actors use it to display deceptive dialog windows that prompt users for system credentials, mimicking genuine macOS authentication alerts:

osascript -e 'display dialog "Software Update requires your password." default answer "" with hidden answer with icon caution'

Because the dialog originates from a trusted process, users frequently enter their credentials. The script captures the entered text and transmits it to an attacker-controlled endpoint.

Attackers also use osascript to interact with applications without triggering user prompts, taking advantage of permissions granted to terminal applications under the Transparency, Consent, and Control (TCC) framework.

Launchctl and persistence staging via plutil

Launchctl controls the macOS service management framework (launchd). It manages background services defined by Property List (.plist) configuration files stored in:

• ~/Library/LaunchAgents: User-level agents executing in the user session.
• /Library/LaunchAgents: System-wide agents loaded upon user login.
• /Library/LaunchDaemons: System daemons executing as root upon system boot.

To establish persistence, an adversary writes a new plist file to one of these directories using plutil or echo, then loads the service using launchctl:

launchctl bootstrap gui/501 ~/Library/LaunchAgents/com.apple.updater.plist

On legacy macOS versions or when targeting root services, attackers use `launchctl load -w /Library/LaunchDaemons/com.evil.daemon.plist`.

Endpoint Security Framework (ESF) telemetry

Apple Endpoint Security Framework delivers system events directly to EDR sensors. When launchctl loads a daemon or osascript executes, the kernel generates ES_EVENT_TYPE_NOTIFY_EXEC and ES_EVENT_TYPE_NOTIFY_CREATE events.

Key fields to inspect include:

• event.exec.target.executable.path: Path to the executing binary (e.g., /usr/bin/osascript).
• event.exec.args: Command-line arguments containing the `-e` inline script string.
• event.exec.target.code_signing_flags: Code signing verification and Team ID.
• event.create.destination: Path where new plist files are created.

In unified logs, query osascript execution using the `log` command:

log show --predicate 'process == "osascript"' --style compact --last 1h

Splunk detection for anomalous osascript execution

This Splunk query identifies osascript commands attempting credential prompting or downloading remote resources:

index=macos sourcetype="mac:endpoint_security"
process_name="/usr/bin/osascript"
(command_line="*display dialog*" AND command_line="*password*") OR command_line="*curl*" OR command_line="*do shell script*"
| table _time, host, user, parent_process_name, command_line

Hardening macOS against LOOBins

Enforce Mobile Device Management (MDM) profiles that prevent users from installing unapproved LaunchDaemons. Use Managed Apple IDs and restrict TCC full disk access permissions to designated administrative tools. Configure unified log forwarding to a centralized SIEM to maintain persistent records of terminal executions.

Consult our osascript LOOBin guide, browse all entries in the macOS catalog, and explore persistence patterns in the Persistence category. You can also review Splunk detection queries for enterprise deployment.

Technical documentation on macOS security includes Apple Developer Documentation on Endpoint Security and MITRE ATT&CK T1059.002: AppleScript.