Detect Launch Agent in Google Chronicle

rule macos_launch_agent_persistence_t1543_001 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects macOS Launch Agent persistence via suspicious plist file creation in LaunchAgent directories or launchctl load/bootstrap execution. Covers Apple name spoofing and shell/interpreter-initiated writes."
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1543.001"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1543/001/"
    severity = "HIGH"
    priority = "HIGH"

  events:
    // Branch 1: Plist file creation in LaunchAgent directories by suspicious processes
    (
      $file_event.metadata.event_type = "FILE_CREATION" or
      $file_event.metadata.event_type = "FILE_MODIFICATION"
    )
    and $file_event.target.file.full_path = /\/Library\/LaunchAgents\/.+\.plist/
    and (
      $file_event.principal.process.file.full_path = /\/(bash|sh|zsh|python3|python|ruby|perl|curl|wget|osascript|node|npm|installer|pkgutil|xattr|mktemp)$/
      or $file_event.target.file.full_path = /com\.apple\.[a-z]+\.[a-z]+\.plist/
      or (
        $file_event.target.file.full_path = /com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist/
        and not $file_event.target.file.full_path = /com\.(apple|microsoft|adobe|google)\./
      )
    )

  match:
    $file_event.principal.hostname over 5m

  outcome:
    $hostname = $file_event.principal.hostname
    $user = $file_event.principal.user.userid
    $plist_path = $file_event.target.file.full_path
    $writer_process = $file_event.principal.process.file.full_path
    $writer_cmdline = $file_event.principal.process.command_line
    $agent_scope = if(
      re.match($file_event.target.file.full_path, "^/System/Library/LaunchAgents/"), "System",
      if(re.match($file_event.target.file.full_path, "^/Library/LaunchAgents/"), "Global", "User")
    )
    $apple_name_spoof = re.match($file_event.target.file.full_path, "com\.apple\.[a-z]+\.[a-z]+\.plist") and
      not re.match($file_event.target.file.full_path, "^/System/Library/")

  condition:
    $file_event
}

rule macos_launchctl_load_bootstrap_t1543_001 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects launchctl load or bootstrap commands targeting LaunchAgent paths, initiated by shell interpreters or download utilities — a key step in activating a malicious launch agent."
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1543.001"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    and $proc.target.process.file.full_path = /\/launchctl$/
    and (
      $proc.target.process.command_line = /load/ or
      $proc.target.process.command_line = /bootstrap/
    )
    and (
      $proc.target.process.command_line = /LaunchAgents/ or
      $proc.target.process.command_line = /\.plist/
    )
    and $proc.principal.process.file.full_path = /\/(bash|sh|zsh|python3|python|ruby|perl|curl|wget|osascript|node|npm|installer|pkgutil)$/

  match:
    $proc.principal.hostname over 5m

  outcome:
    $hostname = $proc.principal.hostname
    $user = $proc.principal.user.userid
    $parent_process = $proc.principal.process.file.full_path
    $parent_cmdline = $proc.principal.process.command_line
    $launchctl_cmdline = $proc.target.process.command_line

  condition:
    $proc
}