AN0047: Analytic 0047
Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.
Analyst context for executives and security teams
This analytic matters because unexpected stopping of macOS daemons or processes can remove business-critical services, suppress defensive tooling, or indicate attempts to eliminate competing processes. For leaders, the decision point is whether macOS endpoints are producing enough log and EDR evidence for the SOC to distinguish authorized administration from suspicious service termination.
Executive priority
Prioritize validation of macOS monitoring where endpoint availability, security tooling continuity, or regulated audit evidence depends on reliable daemon and process visibility. Security leaders should ask whether the organization can prove when launchctl or kill is used to stop services, who initiated it, and whether the activity was approved or investigated.
Technical view
AN0047 is a macOS detection analytic focused on unauthorized termination of system daemons or commands issued through launchctl or kill. SOC and detection teams should validate collection from unified logs and EDR telemetry for unusual service modifications or terminations. Because no ATT&CK tactic, formal detection logic, or relationships were supplied, implementation should be environment-specific and tuned against known administrative maintenance, software updates, and legitimate service management.
Likely telemetry
- macOS unified logs showing service modification or termination activity
- EDR process telemetry for launchctl and kill execution
- Process command-line, parent process, user, and timestamp context where available
- Endpoint records showing daemon or service stop events
- Change or maintenance records to compare against authorized service administration
Detection direction
- Baseline legitimate macOS service management activity before alerting broadly on launchctl or kill usage.
- Correlate service termination events with user context, parent process, command-line details, and affected daemon or process.
- Prioritize unusual terminations of system daemons or security-relevant processes, while accounting for administrative scripts and patching workflows.
- Tune false positives from IT operations, software installers, and normal troubleshooting.
- Identify blind spots where macOS unified logs or EDR telemetry are not retained, not centralized, or lack command-line and user attribution.
Mitigation priorities
- Ensure macOS endpoints are enrolled in centralized logging and EDR collection where business risk warrants monitoring.
- Define and document authorized service-management procedures so investigations can separate approved administration from suspicious activity.
- Restrict administrative privileges and service-control capabilities according to operational need.
- Maintain change-management evidence for planned daemon or process terminations.
- Review alert response procedures so unauthorized service termination can be triaged quickly and escalated when it affects defensive or business-critical services.
Analyst notes and limits
The supplied ATT&CK object provides a description but no official detection logic, tactics, or relationship context. The strongest defensive value is in validating telemetry completeness and operational baselines for macOS service termination rather than treating every launchctl or kill event as malicious.
This take is limited to the supplied STIX fields and external reference. It does not assert active exploitation, attribution, impact, or guaranteed detection coverage. Local endpoint configuration, logging depth, EDR capability, and administrative practices are required to determine practical coverage and alert quality.
Analytic 0047
Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | eeea232fcd6c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0047Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.