redcanaryco/atomic-red-team

Problem: T1543.004 launch-daemon---users-directory

theevilbit opened this issue · 4 comments

There is no such thing as LaunchDaemon in the user's directory on macOS, only LaunchAgent. It should be either changed to that or deleted completely.

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.004/T1543.004.md#atomic-test-2---launch-daemon---users-directory

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

Did anyone take a look at this?

Hello @theevilbit Apologies for the delay. Created a PR now to address this. Thanks for reporting the problem. Appreciate the support.

thanks!