Launchctl - T1152 (53bfc8bf-8f76-4cd7-8958-49a884ddb3ee)
Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as launchctl submit -l . Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.
Adversaries can abuse this functionality to execute code or even bypass whitelisting if launchctl is an allowed process.