New Rule: proc_creation_macos_susp_launchctl_execution.yml

[pratinavchandra]

Summary of the Pull Request

Added a new rule to detect execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

• launchctl can be used to load/start macOS services and execute programs
• It can also be used to load a plist as a LaunchAgent or LaunchDaemon to achieve persistence.
• Example Usage in the wild: load, start, submit
• 
• 
• Atomic Test: https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md

Changelog

new: Launch Agent/Daemon Execution Via Launchctl

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @pratinavchandra 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃