macOS Startup Item Plist Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.