AN0063: Analytic 0063
Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.
Analyst context for executives and security teams
This analytic describes suspicious macOS behavior where launchctl is used to stop services or kill important background processes, potentially followed by file or disk changes. For leaders, the practical issue is resilience: if endpoint security, identity-related, or Apple system services are interrupted, responders may lose visibility or systems may become unstable during an incident.
Executive priority
Prioritize this as a macOS monitoring and response-readiness question: can the organization see and investigate service-disruption behavior on managed Macs, especially when it precedes destructive or evasive changes? It is relevant to SOC coverage, incident containment decisions, endpoint control assurance, and audit evidence that critical macOS activity is logged and reviewable.
Technical view
Validate visibility for macOS command execution involving launchctl used to unload, disable, or remove services, especially from Terminal or remote shell contexts and when followed by process termination or tools such as rm or diskutil. Because ATT&CK provides no official detection logic and no relationship context for this analytic, teams should treat it as a behavior pattern to operationalize locally rather than a complete rule.
Likely telemetry
- macOS process creation and command-line telemetry
- Parent-child process context showing Terminal, shell, or remote shell launching service-management activity
- launchctl activity affecting services or background processes
- Process termination events for critical or Apple-related background processes
- Subsequent file deletion or disk utility activity
Detection direction
- Correlate service-management activity with suspicious execution context, such as interactive terminal or remote shell origins.
- Tune for sequences: service stop or disable behavior, process termination, then follow-on file or disk modification.
- Review allowlisted administrative workflows to reduce false positives from legitimate IT maintenance or software management.
- Pay attention to attempts involving critical system or security-relevant services, while avoiding assumptions that every launchctl use is malicious.
- Confirm whether macOS telemetry captures full command line, parent process, user identity, timestamp, and affected service names.
Mitigation priorities
- Ensure managed macOS endpoints collect process and command-line telemetry suitable for SOC investigation.
- Restrict administrative privileges and remote shell access to users and workflows with documented business need.
- Maintain documented baselines for legitimate service-management activity on macOS systems.
- Prepare incident response procedures for cases where endpoint visibility or critical background services are interrupted.
- Validate endpoint security controls can alert when protected or critical services are stopped or disabled, where supported by local tooling.
Analyst notes and limits
The object is a detection analytic for macOS only. It has no supplied tactics, no official detection text, and no relationships to techniques, groups, malware, or campaigns. The strongest use is as a validation prompt for macOS service-disruption monitoring rather than as evidence of a specific threat actor or intrusion pattern.
Coverage depends on local macOS logging, EDR capability, command-line capture, and administrative baselines. The supplied ATT&CK fields do not provide detection logic, severity, known adversary use, active exploitation, or cross-platform applicability.
Analytic 0063
Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 19eab35d3b4f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0063Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.