Techniques › T1647
T1647 Plist File Modification
defense impairment — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1647
0
KEV CVEs mapped here
<p>Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the <code>info.plist</code> file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.</p><p>Adversaries can modify key-value pairs in plist files to influence system behaviors, such as hiding the execution of an application (i.e. Hidden Window) or running additional commands for persistence (ex: Launch Agent/Launch Daemon or Re-opened Applications).</p><p>For example, adversaries can add a malicious application path to the
~/Library/Preferences/com.apple.dock.plist file, which controls apps that appear in the Dock. Adversaries can also modify the <code>LSUIElement</code> key in an application’s <code>info.plist</code> file to run the app in the background. Adversaries can also insert key-value pairs to insert environment variables, such as <code>LSEnvironment</code>, to enable persistence via Dynamic Linker Hijacking.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0109 Detection Strategy for Plist File Modification (T1647) v1.0
AN0306 macOSMonitor for unexpected modifications of plist files in persistence or configuration directories (e.g., ~/Library/LaunchAgents, ~/Library/Preferences, /Library/LaunchDaemons). Detect when modifications are followed by execution of new or unexpected binaries. Track use of utilities such as defaults, plutil, or text editors making changes to Info.plist files. Correlate file modifications with subsequent process launches or service starts that reference the altered plist.macos:unifiedlog
write: File modifications to *.plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories→ DC0061 File Modificationmacos:unifiedlogexec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files→ DC0032 Process Creationmacos:unifiedlogexec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys→ DC0064 Command ExecutionTunable:MonitoredDirectoriesSuspiciousKeysTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1647
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.