| ID | Name |
|---|---|
| ATAGS-T1064.001 | Launchctl |
| ATAGS-T1064.002 | Service Execution |
| ATAGS-T1064.003 | Systemctl |
Threat actors may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.