Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UT-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as/Library/Preferences(which execute with elevated privileges) and~/Library/Preferences(which execute with a user's privileges). Adversaries can modify these plist files to point to their own code, can use them to execute their code in the context of another user, bypass whitelisting procedures, or even use them as a persistence mechanism. (Citation: Sofacy Komplex Trojan)
Modify MacOS plist file in one of two directories
Supported Platforms: macOS
-
Modify a .plist in
/Library/Preferences
OR
~/Library/Preferences
-
Subsequently, follow the steps for adding and running via Launch Agent