Persistence LOLBins & Scheduled Execution Mechanisms
Adversaries abuse native system utilities to maintain uninterrupted access across system restarts, user logoffs, and credential updates by configuring autostarts, scheduled tasks, and service registrations.
Adversaries abuse tools like schtasks.exe, sc.exe, at.exe, and systemd to establish resilient foothold mechanisms masquerading as legitimate administrative maintenance.
Catalog of Persistence LOLBins
Displaying 6 itemstee
Tee reads from standard input and writes to standard output and files. Attackers abuse SUID or sudo tee to append unauthorized credentials to /etc/passwd or overwrite system configuration.
echo "backdoor:x:0:0::/root:/bin/bash" | tee -a /etc/passwdsystemctl
Systemctl controls the systemd system and service manager. Sudo privileges on systemctl allow linking or creating transient unit files that execute root commands upon service start.
systemctl link /tmp/malicious.service && systemctl start maliciousdscl
Directory Service command-line utility (dscl) allows reading and writing Directory Service databases. Attackers use dscl for local user discovery, creating hidden administrator accounts, or extracting password hashes.
dscl . -create /Users/sysadmin UserShell /bin/zsh && dscl . -append /Groups/admin GroupMembership sysadmindefaults
Defaults reads and writes macOS user defaults and plist configuration files. Attackers abuse it to write LoginHook scripts or alter ScreenSaver preferences to achieve reboot persistence.
defaults write com.apple.loginwindow LoginHook /Library/Scripts/update.shplutil
Plutil checks and transforms property list (.plist) files. Attackers use plutil -insert to inject payload paths into LaunchAgent or LaunchDaemon plists for persistence.
plutil -insert ProgramArguments.0 -string "/bin/sh" ~/Library/LaunchAgents/com.apple.updater.plistlaunchctl
Launchctl interfaces with launchd to manage daemons and user agents. Malware uses launchctl to immediately bootstrap and execute persistent services.
launchctl load -w ~/Library/LaunchAgents/com.persistence.plistExplore Other Attack Objectives & Tactics
