macOS Launch Daemon Plist Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.