Detect Launch Agent in CrowdStrike LogScale

// Branch 1: Plist file creation in LaunchAgent directories by suspicious initiating processes
#repo=base_sensor_telemetry
| #event_simpleName IN (MacFileCreationV1, MacFileWrittenV1)
| TargetPath = /\/Library\/LaunchAgents\/.+\.plist/
| SuspiciousWriter := match(field=ImageFileName, regex="/(bash|sh|zsh|python3|python|ruby|perl|curl|wget|osascript|node|npm|installer|pkgutil|xattr|mktemp)$")
| AppleNameSpoof := match(field=TargetPath, regex="com\.apple\.[a-z]+\.[a-z]+\.plist") AND NOT match(field=TargetPath, regex="^/System/Library/")
| RandomName := match(field=TargetPath, regex="com\.[a-z0-9]{4,10}\.[a-z0-9]{4,10}\.plist") AND NOT match(field=TargetPath, regex="(com\.apple\.|com\.microsoft\.|com\.adobe\.|com\.google\.)")
| AgentScope := if(TargetPath = /^\/System\/Library\/LaunchAgents\//, "System",
    if(TargetPath = /^\/Library\/LaunchAgents\//, "Global", "User"))
| RiskScore := if(SuspiciousWriter, 1, 0) + if(AppleNameSpoof, 1, 0) + if(RandomName, 1, 0)
| RiskScore > 0
| table([@timestamp, ComputerName, UserName, TargetPath, ImageFileName, CommandLine, AgentScope, SuspiciousWriter, AppleNameSpoof, RandomName, RiskScore])
| sort(RiskScore, order=desc)

// Branch 2: launchctl load or bootstrap targeting LaunchAgent paths
// Run as a separate query or union via saved searches
#repo=base_sensor_telemetry
| #event_simpleName IN (MacProcessRollup2, ProcessRollup2)
| ImageFileName=/\/launchctl$/
| (CommandLine=/\bload\b/ OR CommandLine=/\bbootstrap\b/)
| (CommandLine=/LaunchAgents/ OR CommandLine=/\.plist/)
| ParentBaseFileName := FileName(ParentImageFileName)
| SuspiciousParent := match(field=ParentBaseFileName, regex="^(bash|sh|zsh|python3|python|ruby|perl|curl|wget|osascript|node|npm|installer|pkgutil)$")
| AppleNameSpoof := match(field=CommandLine, regex="com\.apple\.[a-z]+\.[a-z]+\.plist") AND NOT match(field=CommandLine, regex="/System/Library/")
| AgentScope := if(CommandLine=/\/System\/Library\/LaunchAgents/, "System",
    if(CommandLine=/\/Library\/LaunchAgents/, "Global", "User"))
| table([@timestamp, ComputerName, UserName, CommandLine, ParentBaseFileName, AgentScope, SuspiciousParent, AppleNameSpoof])
| sort(@timestamp, order=desc)