T1547.011 · threatengine.sh

Home/ATT&CK Technique/Plist Modification

ATT&CK Technique

Plist Modification

T1547.011 · persistence, privilege-escalation

▤ Generate a SIEM detection for T1547.011 ◈ Vendor-native detections for T1547.011 ⚠ CVEs mapped to T1547.011 ♛ Hunt package for T1547.011 ◎ Check your coverage for T1547.011

Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence. Plist files are used by macOS applications to store properties and configuration settings for applications and services. Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values.

Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format. Adversaries can modify paths to executed binaries, add command line arguments, and insert key/pair values to plist files in auto-run locations which execute upon user logon or system startup. Through modifying plist files in these locations, adversaries can also execute a malicious dynamic library (dylib) by adding a dictionary containing the DYLD_INSERT_LIBRARIES key combined with a path to a malicious dylib under the EnvironmentVariables key in a plist file.

Upon user logon, the plist is called for execution and the malicious dylib is executed within the process space. Persistence can also be achieved by modifying the LSEnvironment key in the application's Info.plist file.

macOS

▸ How to use this page - the detection-engineering loop

Attackers have goals (tactics - “get credentials”, “move laterally”) and techniques are the concrete methods they use to reach them. This page is one method - T1547.011 - broken into everything you need to catch it.

The loop this page is built for (this is the job):

Understand the behaviour - read the description and the Atomic Tests to see exactly what the attacker does on a host or network.
Find the telemetry - what data source would reveal it (process creation, registry, network flow, auth logs). Detection Coverage shows which surfaces already have a rule and which are blind.
Get or write the detection - adapt ready logic (CAR Analytics, SIEM Detections, Falco, or Sigma via Generate a SIEM detection), or author your own.
Test it - run an Atomic Test in a lab and confirm your rule actually fires. A detection you have not tested is a hope, not coverage.
Deploy and tune - push it, then watch for false positives and adjust.

What each panel is for:

Atomic Testssafely reproduce the technique in a lab to validate that a detection fires. Detection Coveragewhich detection surfaces have a rule for this technique; none is a blind spot to close, or simply not applicable (YARA matches files, not network behaviour). CAR / SIEM / Falcoready-made detection logic (Splunk SPL, Elastic EQL, Sentinel KQL, Falco) you adapt to your own SIEM. Mitigationsreduce exposure so the technique is harder to use at all - prevent, not just detect. Actors / Attributionwho actually uses this, so you prioritise by your own threat model. Attack Path / LOTLwhat attackers do before and after this step, and the legitimate tools they abuse to do it.

Where this fits: you usually arrive here from a CVE (“which techniques does it enable”) and leave with a tested detection deployed. The buttons above jump straight to building one, the deployable rules, the CVEs that use T1547.011, and a hunt package.

◈

Detection Coverage

1/9 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) none

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

SIEM (Splunk ESCU) none

SIEM (Elastic) 2

SIEM (Azure Sentinel) none

◈

SIEM Detections

Production detection rules from Splunk ESCU, Elastic, and Azure Sentinel that map to this technique. Query language varies by platform (SPL / EQL / KQL).

ElastichighPersistence via Suspicious Launch Agent or Launch Daemon

ElastichighPersistence via a Hidden Plist Filename

▣

Comply & Defend

D3FEND11 defensive techniques

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)