Detect Plist File Modification in IBM QRadar
This detection identifies adversarial modification of macOS property list (plist) files to enable persistence, evade defenses, or alter application behavior. Attackers use tools such as plutil, PlistBuddy, and the defaults command to insert or modify keys like LSUIElement (hide app from UI), LSEnvironment (inject environment variables for dynamic linker hijacking), RunAtLoad, and ProgramArguments in LaunchAgent or LaunchDaemon plists. Known malware families including XCSSET and Cuckoo Stealer abuse plist modification to persist across reboots and conceal malicious processes. The detection monitors process execution of common plist editing utilities with arguments targeting sensitive keys and system persistence paths.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1647 Plist File Modification
- Canonical reference
- https://attack.mitre.org/techniques/T1647/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
"username" AS AccountName,
"CommandLine" AS CommandLine,
"ParentProcessName" AS ParentProcess,
"NewProcessName" AS ProcessName,
CASE
WHEN "CommandLine" ILIKE '%powershell%' AND "CommandLine" ILIKE '%-enc%' THEN 'EncodedCommand'
WHEN "CommandLine" ILIKE '%bypass%' THEN 'ExecutionBypass'
WHEN "CommandLine" ILIKE '%-noprofile%' THEN 'NoProfileExecution'
ELSE 'SuspiciousProcess'
END AS DetectionType,
CASE
WHEN "username" = 'SYSTEM' THEN 70
WHEN "CommandLine" ILIKE '%bypass%' THEN 85
ELSE 60
END AS RiskScore
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Universal DSM')
AND eventid IN (4688, 1)
AND ("NewProcessName" ILIKE '%powershell.exe%'
OR "NewProcessName" ILIKE '%cmd.exe%'
OR "NewProcessName" ILIKE '%wscript.exe%'
OR "NewProcessName" ILIKE '%cscript.exe%'
OR "NewProcessName" ILIKE '%mshta.exe%')
AND RiskScore >= 60
ORDER BY EventTime DESC
LAST 1 HOURSIBM QRadar AQL detection for Plist File Modification (T1647). Queries QRadar event pipeline for indicators consistent with plist file modification adversary techniques using MITRE ATT&CK-aligned event categorization.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macOS application installers using plutil or PlistBuddy to configure app preferences during setup
- System administrators using the defaults command to manage enterprise preferences and MDM profiles
- Developer tooling such as Xcode build scripts or CocoaPods that modify Info.plist during compilation
Other platforms for T1647
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Modify LSUIElement to hide macOS application via plutil
Expected signal: DeviceProcessEvents: plutil process with -insert LSUIElement argument targeting a .plist file path; InitiatingProcessFileName will be the shell (bash/zsh)
- Test 2Write malicious LaunchAgent plist for persistence via PlistBuddy
Expected signal: DeviceProcessEvents: PlistBuddy with multiple Add command invocations targeting ~/Library/LaunchAgents/; DeviceFileEvents: .plist file creation in LaunchAgents directory
- Test 3Inject LSEnvironment with DYLD_INSERT_LIBRARIES for dynamic linker hijacking setup
Expected signal: DeviceProcessEvents: PlistBuddy with 'Add :LSEnvironment dict' and 'Add :LSEnvironment:DYLD_INSERT_LIBRARIES' command arguments; high-fidelity process args containing both LSEnvironment and DYLD_INSERT_LIBRARIES strings
References (7)
- https://attack.mitre.org/techniques/T1647/
- https://objective-see.org/blog.html
- https://www.sentinelone.com/blog/cuckoo-stealer-macos-malware/
- https://www.welivesecurity.com/2012/03/02/the-flashback-files-a-closer-look-at-the-osx-flashback-malware-family/
- https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Introduction/Introduction.html
- https://www.kandji.io/blog/cuckoo-malware
- https://www.microsoft.com/en-us/security/blog/2022/01/27/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/
Unlock Pro Content
Get the full detection package for T1647 including response playbook, investigation guide, and atomic red team tests.