LaunchAgents and LaunchDaemons: Closing the vulnerability — by Howard Oakley (Eclectic Light Company)

intermediatepageLink only (©)

Security-focused look at the LaunchAgents and LaunchDaemons folders: where they are, which are SIP-protected under /System/Library and which are not, and why malware uses them to persist. Useful for knowing which launch folders to audit.

Read the full article on eclecticlight.co

Source: LaunchAgents and LaunchDaemons: Closing the vulnerability by Howard Oakley (Eclectic Light Company). Licence: Link only (©).

Source reviewed: 2026-11-02
Link checked: 2026-11-02
Tested hands-on: Not by Oddbyte.Me

launchdsecuritypersistencemacos

More in Scheduling (Task Scheduler, launchd, cron)

Jack of all tasks: launchd, and how to run periodic tasks — by Howard Oakley (Eclectic Light Company)

intermediatepage

Older but useful explanation of launchd replacing cron on the Mac, the five folders where launch plists live, and the difference that agents can interact with the user session while daemons cannot. Suggests checking for legacy crontabs and mentions the Lingon X editor.

Run bash (.sh) via launchd using a plist in /Library/LaunchAgents — by VikingOSX and etresoft on Apple Community

intermediateforum

VikingOSX shows a working LaunchAgent for a shell script: plist in ~/Library/LaunchAgents with 644 permissions, Label, RunAtLoad, StartInterval and full paths only. The original poster got theirs working after moving the script out of ~/Documents, and etresoft points to privacy permissions instead, noting shell scripts silently fail without Full Disk Access.

Run PowerShell as Scheduled Task — by Microsoft Q&A community (accepted answer, anonymous) with Rich Matheisen

intermediateforum

A script that worked by hand failed under Task Scheduler. The accepted answer says not to tick Do not store password when using Run whether user is logged on or not, since the task then cannot reach network resources, and to isolate the problem with a trivial test script and -noexit. Rich Matheisen recommends Start-Transcript for diagnosis and says two-factor authentication won't work in a scheduled task; the poster suspected a smart-card PIN prompt. No confirmed final fix is recorded.