Which technique involves modifying plist files to execute code at startup and to escalate privileges?

Which technique involves modifying plist files to execute code at startup and to escalate privileges?

• A. InSpectre
• B. Plist Modification
• C. Launch Daemon
• D. BeRoot

Answer: (B)

Modifying plist files on macOS takes advantage of launchd to run code at startup. A plist (Property List) defines a launch item—what to execute, with which parameters, and when (for example, RunAtLoad). By editing or placing a plist in system-wide locations like /Library/LaunchDaemons (which run with root privileges) and enabling RunAtLoad, the payload can execute automatically when the system boots, enabling persistence and potential privilege escalation. This focus on altering the plist configuration is what makes it the best description of the technique, since it directly describes how startup execution and elevated privileges can be achieved.

Modifying plist files on macOS takes advantage of launchd to run code at startup. A plist (Property List) defines a launch item—what to execute, with which parameters, and when (for example, RunAtLoad). By editing or placing a plist in system-wide locations like /Library/LaunchDaemons (which run with root privileges) and enabling RunAtLoad, the payload can execute automatically when the system boots, enabling persistence and potential privilege escalation. This focus on altering the plist configuration is what makes it the best description of the technique, since it directly describes how startup execution and elevated privileges can be achieved.