HighCompromise indicatorsBLWK-PERSIST-003

Unexpected LaunchAgent/LaunchDaemon found

What this means

The LaunchAgent/LaunchDaemon “‹label›” runs on every login/boot and isn't one this host's baseline recognizes — macOS's equivalent of a rogue systemd unit.

How to fix it

Review the plist under ~/Library/LaunchAgents or /Library/Launch{Agents,Daemons} and remove it if you didn't create it.

Check it yourself

Run a scan and look for BLWK-PERSIST-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads launchd_persistence and reports this check when:

recognized == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1543.001

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005