All Detections

Launchctl ChromeUpdater Persistence

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026005

Identifies the payload establishing persistence on macOS by utilizing launchctl to load the fake ChromeUpdater plist job.

Microsoft Sentinel (KQL)