Get macfor Pro

Pro plugin

Persistence Mechanisms

Inventories macOS persistence mechanisms including launch items, login items, scheduled tasks, shell configs, kernel/system extensions, authorization plugins, configuration profiles, and legacy persistence vectors

system.persistencePromacOS 10.15+v1.0.0systemsecuritypersistence

Run this plugin

Trigger collection for Persistence Mechanisms on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin system.persistence --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin system.persistence --dry-run

Compatibility

  • macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (20 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

persistence

ArtifactFormatPathNotes
Launch Agents
persistence_launch_agenthigh value
binary_plist~/Library/LaunchAgents/*.plist
+1 more
  • /Library/LaunchAgents/*.plist
—
Launch Daemons
persistence_launch_daemonhigh value
binary_plist/Library/LaunchDaemons/*.plist—
Launch Overrides
persistence_launch_overridemedium value
binary_plist/var/db/launchd.db/com.apple.launchd/overrides.plist
+2 more
  • /private/var/db/com.apple.xpc.launchd/disabled.plist
  • /private/var/db/com.apple.xpc.launchd/disabled.*.plist
—
BTM Database Items
persistence_btm_itemhigh value
binary_plist/private/var/db/com.apple.backgroundtaskmanagement/BackgroundItems-v*.btmmacOS 13.0+NSKeyedArchiver-encoded binary plist. Requires native Go decoder.
Legacy Login Items
persistence_login_itemhigh value
binary_plist~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm
+3 more
  • ~/Library/Preferences/com.apple.loginitems.plist
  • ~/Library/Preferences/com.apple.loginwindow.plist
  • ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist
—
Login Hooks
persistence_login_hookhigh value
binary_plist/var/root/Library/Preferences/com.apple.loginwindow.plist
+1 more
  • ~/Library/Preferences/com.apple.loginwindow.plist
Deprecated since macOS 10.11. Presence is suspicious.
Cron Jobs
persistence_cron_jobhigh value
text/usr/lib/cron/tabs/*
+2 more
  • /var/at/tabs/*
  • /etc/crontab
—
Periodic Scripts
persistence_periodic_scriptmedium value
text/etc/periodic/daily/*
+5 more
  • /etc/periodic/weekly/*
  • /etc/periodic/monthly/*
  • /usr/local/etc/periodic/daily/*
  • /usr/local/etc/periodic/weekly/*
  • /usr/local/etc/periodic/monthly/*
—
At Jobs
persistence_at_jobmedium value
text/var/at/jobs/*
+1 more
  • /private/var/at/jobs/*
—
Shell Configuration Files
persistence_shell_configSensitivemedium value
text~/.zshenv
+15 more
  • ~/.zprofile
  • ~/.zshrc
  • ~/.zlogin
  • ~/.zlogout
  • ~/.bash_profile
  • ~/.bashrc
  • ~/.bash_login
  • ~/.bash_logout
  • ~/.profile
  • ~/.config/fish/config.fish
  • /etc/zshrc
  • /etc/zprofile
  • /etc/zshenv
  • /etc/bashrc
  • /etc/profile
May contain credentials or sensitive environment variables.
Authorization Plugins
persistence_auth_pluginhigh value
directory/Library/Security/SecurityAgentPlugins/*.bundleThird-party auth plugins can intercept login credentials.
Kernel Extensions
persistence_kexthigh value
directory/Library/Extensions/*.kext—
KextPolicy Database
persistence_kext_policymedium value
sqlite/var/db/SystemPolicyConfiguration/KextPolicy—
Kext Load History
persistence_kext_loadmedium value
sqlite/var/db/SystemPolicyConfiguration/KextPolicyExtracted from kext_load_history_v3 table in KextPolicy database.
System Extensions
persistence_system_extensionmedium value
binary_plist/Library/SystemExtensions/db.plist
+1 more
  • /Library/SystemExtensions/*/*.systemextension
—
Configuration Profiles
persistence_config_profilehigh value
binary_plist/var/db/ConfigurationProfiles/Store/*.plist
+1 more
  • /var/db/ConfigurationProfiles/Settings/*.plist
—
emond Rules
persistence_emond_rulehigh value
binary_plist/etc/emond.d/rules/*.plist
+1 more
  • /etc/emond.d/emond.plist
emond removed in macOS 12.3+. Presence on newer systems is highly suspicious.
emond Clients
persistence_emond_clienthigh value
text/private/var/db/emondClients/*Any file in this directory activates the emond daemon.
Startup Items
persistence_startup_itemmedium value
directory/Library/StartupItems/*Legacy mechanism removed in macOS 13. Presence on newer systems is suspicious.
DYLD Injection Artifacts
persistence_dyld_artifactcritical value
text/etc/launchd.conf
+1 more
  • /etc/dyld/*
launchd.conf should not exist on macOS 10.10+. /etc/dyld/ is non-standard.