Potential Persistence Via PlistBuddy (65d506d3-fcfe-4071-b4b2-bcefe721bbbb)

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Launch Daemon - T1543.004 (573ad264-1371-4ae0-8482-d2673b719dba)	Attack Pattern	Potential Persistence Via PlistBuddy (65d506d3-fcfe-4071-b4b2-bcefe721bbbb)	Sigma-Rules	1
Launch Agent - T1543.001 (d10cbd34-42e3-45c0-84d2-535a09849584)	Attack Pattern	Potential Persistence Via PlistBuddy (65d506d3-fcfe-4071-b4b2-bcefe721bbbb)	Sigma-Rules	1
Launch Daemon - T1543.004 (573ad264-1371-4ae0-8482-d2673b719dba)	Attack Pattern	Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5)	Attack Pattern	2
Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5)	Attack Pattern	Launch Agent - T1543.001 (d10cbd34-42e3-45c0-84d2-535a09849584)	Attack Pattern	2