ZEKASTRA

macOSCorePersistence

Launch agents and launch daemons

launchd property lists that start programs at boot, login or on triggers; the main macOS persistence locations and the keys that define them.

01Location

  • ~/Library/LaunchAgents/*.plist
  • /Library/LaunchAgents/*.plist
  • /Library/LaunchDaemons/*.plist
  • /System/Library/LaunchAgents/*.plist
  • /System/Library/LaunchDaemons/*.plist

02Questions it answers

  • Which programs are configured to start automatically, for all users or for one user?
  • What executable and arguments does each job run, and under which trigger?
  • Was a job added outside the vendor-provided /System locations?

03Format and versions

FormatProperty list (XML or binary) read by launchd. Daemons are system-wide; agents run per user and only while that user is logged in.
Applies toLocations from launchd.plist(5) and Apple's daemon guide. From macOS 13, SMAppService registers agents and daemons that live inside an app bundle instead of installing plists in these folders.

04Key fields

FieldWhat it tells you
LabelUnique string identifying the job to launchd (required).
Program / ProgramArgumentsExecutable path and argument vector; Program is required if ProgramArguments is absent.
RunAtLoadLaunch the job once when it is loaded (default false).
KeepAliveKeep the job running rather than launching on demand.
StartInterval, StartCalendarIntervalRun every N seconds, or on a cron-like calendar schedule.
WatchPaths, QueueDirectoriesStart the job when watched paths change or while directories are non-empty.

05Examination workflow

  1. Collect all five locations plus each user's ~/Library/LaunchAgents.
  2. Parse each plist and tabulate Label, Program/ProgramArguments and trigger keys.
  3. Check that the referenced executables exist, and review their code signatures and file system times.
  4. On macOS 13 and later, also review login and background items with sfltool dumpbtm.

06Interpretation pitfalls

  • Property lists contain no installation time; dating relies on file system timestamps and logs.
  • Globally installed jobs must be owned by root and not be group- or world-writable; deviations deserve attention.
  • Helpers registered through SMAppService do not need a plist in these folders, so an empty folder does not rule out background items.
  • The launchd.plist(5) page cited is from Apple's open-source launchd release and may not list keys added later.

08Sources

  1. launchd.plist(5) manual page Apple open source (apple-oss-distributions/launchd, GitHub) · checked 2026-10-14
  2. Daemons and Services Programming Guide — Creating Launch Daemons and Agents Apple Developer Documentation Archive · checked 2026-10-14
  3. SMAppService Apple Developer Documentation · checked 2026-10-14
  4. Manage login items and background tasks on Mac Apple Platform Deployment · checked 2026-10-14
  5. ForensicArtifacts — artifacts/data/macos.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14