macOS Emond Launch Daemon Persistence

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.