/inspect-macos-persistence

name: inspect-macos-persistence
description: Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.

Inspect macOS Persistence

Overview

Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.

Read [references/macos-persistence-surfaces.md](references/macos-persistence-surfaces.md) for prioritized surfaces and evidence fields.

Workflow

1. Record host/build, user domains, event timeline, and the suspected executable or label.

• Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.

2. Inventory user-visible registrations.

• Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.

3. Inventory launch services.

• Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through `launchctl` read operations.
• Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.

4. Inspect adjacent persistence.

• Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.

5. Correlate provenance and runtime.

• Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.

6. Classify each item.

• Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.
• Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.

7. Preserve before containment.

• Record files and service state before using official `launchctl bootout` or app/uninstaller paths in the containment workflow.

Output

Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.