Which macOS persistence mechanism can be installed to run at boot by loading a plist via launchd/launchctl?

Which macOS persistence mechanism can be installed to run at boot by loading a plist via launchd/launchctl?

• A. Sudo
• B. Kernel Exploits
• C. Launch Daemon
• D. Web Shell

Answer: (C)

In macOS, persistence at boot through a plist loaded by launchd/launchctl is accomplished with a Launch Daemon. A Launch Daemon is a system-wide service defined by a plist placed in /Library/LaunchDaemons. This plist specifies what to run (Program or ProgramArguments) and can include RunAtLoad to start automatically when launchd loads it at boot. Since these daemons run as root, they provide persistence across reboots. This setup is distinct from Launch Agents, which run per user after login, not at system boot. Sudo is just a privilege escalation tool, not a startup item. Kernel exploits and web shells are different attack methods and not the mechanism described.

In macOS, persistence at boot through a plist loaded by launchd/launchctl is accomplished with a Launch Daemon. A Launch Daemon is a system-wide service defined by a plist placed in /Library/LaunchDaemons. This plist specifies what to run (Program or ProgramArguments) and can include RunAtLoad to start automatically when launchd loads it at boot. Since these daemons run as root, they provide persistence across reboots. This setup is distinct from Launch Agents, which run per user after login, not at system boot. Sudo is just a privilege escalation tool, not a startup item. Kernel exploits and web shells are different attack methods and not the mechanism described.