There is more to macOS persistence than Launch Agents. This talk goes over some lesser utilized macOS persistence methods. We will walk through how these methods work, how automation can be leveraged to quickly execute these from an offensive perspective, and how defenders can leverage indicators of these methods to assist in detection efforts. Contact Twitter: https://twitter.com/_d00mfist Blog: http://posts.specterops.io/@D00MFist Slack: https://bloodhoundgang.herokuapp.com/ Projects & Research Persistent JXA: https://github.com/D00MFist/PersistentJXA JXA Blog: https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5 InSync: https://github.com/D00MFist/InSync macOS Dock Persistence: https://posts.specterops.io/are-you-docking-kidding-me-9aa79c24bdc1 References Mythic: https://github.com/its-a-feature/Mythic Crescendo: https://github.com/SuprHackerSteve/Crescendo Zsh Intro: Zsh.sourceforge.net/intro/intro_3.html ATT&CK: https://attack.mitre.org/techniques/T1053/003/ 'Mac File Opener' Persistence: https://objective-see.com/blog/blog_0x11.html Application Scripts: https://theevilbit.github.io/posts/macos_persisting_through-application_script_files/ TrueTree: https://themittenmac.com/incident-response-with-truetree/ Venator: https://github.com/richiercyrus/Venator-Swift Launch Agents : https://attack.mitre.org/techniques/T1543/001/ Launch Daemons: https://attack.mitre.org/techniques/T1543/004/ Login Items: https://objective-see.com/blog/blog_0x31.html Folder Actions: https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d Dylib Hijacking: https://www.virusbulletin.com/virusbulletin/2015/03/dylib-hijacking-os-x Emond: https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124 Periodics: https://www.sentinelone.com/blog/how-malware-persists-on-macos/ Chrome Extensions​: https://posts.specterops.io/no-place-like-chrome-122e500e421f  Spotlight Importer & Quicklook Plugins​: https://theevilbit.github.io/posts/macos_persistence_spotlight_importers/​ Audio Plugins: https://posts.specterops.io/audio-unit-plug-ins-896d3434a882 Login/Logout Hooks​: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf​ Calendar Events​: https://labs.f-secure.com/blog/operationalising-calendar-alerts-persistence-on-macos ​ At Jobs: https://www.sentinelone.com/blog/how-malware-persists-on-macos/