MITRE ATT&CK — T1569.001 Launchctl

Name: MITRE ATT&CK — T1569.001 Launchctl
Rating: 82 (1 reviews)
Author: santosomar

Trust Score 82/100

Defensive analysis skill for MITRE ATT&CK T1569.001 (Launchctl): detection, triage, and mitigation guidance for macOS adversary activity.

triggers:T1569.001LaunchctllaunchctlmacOS executionLaunch AgentLaunch DaemonATT&CK mapping

GitHub SKILL.md

What it does

Provides structured defensive analysis and reporting for the MITRE ATT&CK sub-technique T1569.001 (Launchctl). The skill maps observations to ATT&CK concepts, suggests telemetry sources and detection logic, and produces templates for detection briefs, hunt plans, and incident-response notes.

When to use it

Use this skill when investigating macOS activity that may involve launchctl, when building detection rules or telemetry collection for Launch Agents/Daemons, during threat-hunting focused on execution techniques, or when preparing controlled adversary-emulation exercises that require safe, defensive-only guidance.

What's included

Scripts: rendering helper scripts under scripts/ for generating briefs (has_scripts=true).
References: ATT&CK metadata, detection-and-mitigation notes, and templates under references/ and templates/ (has_references=true).
Instructions: procedural guidance for triage, mapping evidence to ATT&CK, triage checklists, and recommended output structure (assessment, evidence, detection, response, coverage gaps, references).

Compatible agents

Designed for defensive/security analysis agents and research assistants with code and markdown capabilities (Copilot/Code assistants, Codex-style agents, and CLI-capable models).

Audit Summary

Defensive analysis skill for MITRE ATT&CK T1569.001 (Launchctl) on macOS. SKILL.md is well-structured with clear triggers, workflow steps, and bundled resource references. The single script (render_brief.py) reads a local JSON profile and renders Markdown, but fails when the references/ directory isn't present alongside it — a portability issue. No security concerns; the script is purely local file I/O with no network calls or destructive operations.

Watch Out

Script fails if run outside the full skill directory (missing references/technique-profile.json)
No ATT&CK detection guidance or data sources in the STIX object for this technique

Notes

Part of the santosomar/mitre-attack-agent-skills repo — a collection of ATT&CK technique skills. Well-organized SKILL.md with frontmatter, agent workflow, detection guidance, and templates. The render_brief.py script is a simple local Markdown generator with no security issues. Main weakness is the script's dependency on an unbundled reference file, causing it to crash in isolation.

Information

Repository: mitre-attack-agent-skills
Stars: 18

Trust Score

Overall82

Security100

Code Quality62

Architecture68

Usefulness45

More from mitre-attack-agent-skills

MITRE ATT&CK T1098 — Account Manipulation

Defensive analysis and guidance for MITRE ATT&CK technique T1098 (Account Manipulation): detection, triage, hunting, and mitigation planning for enterprise envi

MITRE ATT&CK T1557.001: Name Resolution Poisoning & SMB Relay

Defensive analysis skill for MITRE ATT&CK T1557.001: helps triage, detection engineering, hunting, and incident response for name-resolution poisoning and SMB r

ATT&CK T1560.003 — Archive via Custom Method

Defensive analysis skill for MITRE ATT&CK T1560.003: helps map observations, produce detection ideas, and create triage and mitigation briefs for custom archive

MITRE ATT&CK — Hidden Files & Directories (T1564.001)

Defensive analysis aid for MITRE ATT&CK T1564.001 to help triage, detection engineering, hunting, and incident response around hidden files and directories.

MITRE ATT&CK T1633.001 — System Checks

Defensive analysis skill for MITRE ATT&CK T1633.001 (System Checks) — aids triage, detection engineering, hunting, and emulation planning for mobile platforms.

Related Skills

Reverse Engineer

Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for

Sandbox0 Integration

Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.

Monetization Strategy (Apple)

End-to-end monetization guidance for iOS/macOS apps: readiness assessment, pricing model selection, tier design, free trial strategy, and implementation guidanc

Stellar iOS & Mac SDK

Native Swift SDK and guidance for building Stellar blockchain apps on iOS/macOS: transaction building, signing, Horizon queries, Soroban RPC, XDR handling, and

CTF Write-up Generator

Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.

EventKit Integration (iOS/macOS)

Expert EventKit patterns for iOS/macOS: permissions, bidirectional sync, zero-width identity signatures, batch operations, and zombie-task handling.

Azure External Attack Surface Management

Provides expert guidance for Azure External Attack Surface Management (EASM): quotas, configuration, integrations, and exporting inventory to analytics platform

Node.js Best Practices

Guidelines and decision-making for Node.js architecture, runtime, async patterns, security, validation, and testing to inform framework and system choices.

Back to Skills