Insistence on Persistence

Huntress presents its new macOS agent focused on detecting persistence mechanisms—primarily Launch Daemons and Launch Agents—and outlines additional macOS persistence vectors it monitors or plans to cover (e.g., Login Hooks/Items, `cron`, periodic scripts, overrides, Emond, and System Extensions). The report emphasizes that persistence is central to malware efficacy, details common on-disk locations for these mechanisms, and highlights analyst review to differentiate benign from malicious entries, positioning persistence visibility as the starting point for macOS threat detection.