evilquest | 5d89f7e03233ba53fecffbe2f0b69f1e99a7a7ad7bdc1065f1cf7a021ae1325a

Analysis

max time kernel
148s
max time network
123s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30/10/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe
Size 168KB
Sample261030-3jp2bas17p
SHA256 5d89f7e03233ba53fecffbe2f0b69f1e99a7a7ad7bdc1065f1cf7a021ae1325a
MD5 80e4cf80449fcef88fcfb3954c983f78
SHA1 125b01a0f5d9306de24e1c53941812c8ecc37437
SHA512 ba25efbcf1c980345c11604bf4df6a650c1be8a92828a317c3475c1f4471932156dbf9752847d90670f3fc52a92c5da5fc034681e1cddd9adc5f347b9928d257
SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9EOf0:5SeOQdaZNxtk8cqhSxvHY9P
TLSH
T157F393B35260D459C05FC4F037DA9AF26D1078394AB0725E2BD14E7B6FB6CC056AE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor execution evilquest persistence

Malware Config

Signatures

Family: EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008b5cf-0.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-3.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-8.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-13.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-18.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-23.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-29.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-33.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-38.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-43.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-48.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-53.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-58.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-63.dat	family_evilquest
behavioral1/files/0x000000030008b5cf-68.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 12 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh

Modifies service states with Launchctl 1 TTPs 24 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	sh
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	launchctl
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	launchctl
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	launchctl
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	bash
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	launchctl
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	bash
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	sh
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	bash
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	osascript
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	sh

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe\""
1⤵
PID:466

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe\""
1⤵
PID:466

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:467

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe
1⤵
PID:466
- /bin/zsh
  /bin/zsh -c /Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe
  2⤵
  PID:472
- /Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe
  /Users/run/2026-10-30_80e4cf80449fcef88fcfb3954c983f78_adload_evilquest_rekoobe
  2⤵
  PID:472
- - /bin/sh
    sh -c "sysctl -n hw.ncpu"
    3⤵
    PID:473
- - /bin/bash
    sh -c "sysctl -n hw.ncpu"
    3⤵
    PID:473
- - /usr/sbin/sysctl
    sysctl -n hw.ncpu
    3⤵
    PID:473
- - /bin/sh
    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:499
- - /bin/bash
    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:499
- - /usr/bin/osascript
    osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:499
- - /bin/sh
    sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:503
- - /bin/bash
    sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:503
- - /usr/bin/osascript
    osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:503
- - /bin/sh
    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:506
- - /bin/bash
    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:506
- - /usr/bin/osascript
    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:506
- - /bin/sh
    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:509
- - /bin/bash
    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:509
- - /usr/bin/osascript
    osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
    3⤵
    - AppleScript
    - Modifies service states with Launchctl
    PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.csrutil.report
1⤵
PID:468

/usr/libexec/xpcproxy
xpcproxy com.apple.emond.aslmanager
1⤵
PID:469

/usr/sbin/aslmanager
/usr/sbin/aslmanager -s /var/log/eventmonitor
1⤵
PID:469

/usr/bin/csrutil
/usr/bin/csrutil report
1⤵
PID:468

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:500

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:500
- /bin/sh
  /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:501
- /bin/bash
  /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:501
- /bin/launchctl
  launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
  2⤵
  - Modifies service states with Launchctl
  PID:501
- /bin/sh
  /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:505
- /bin/bash
  /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:505
- /bin/launchctl
  launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
  2⤵
  - Modifies service states with Launchctl
  PID:505
- /bin/sh
  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:507
- /bin/bash
  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:507
- /bin/launchctl
  launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
  2⤵
  - Modifies service states with Launchctl
  PID:507
- /bin/sh
  /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:510
- /bin/bash
  /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
  2⤵
  - Modifies service states with Launchctl
  PID:510
- /bin/launchctl
  launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
  2⤵
  - Modifies service states with Launchctl
  PID:510

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:502

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:502
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:504
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:504
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:511

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:516

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:516
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:517
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:517
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:517

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:520

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:520
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:521
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:521
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:521

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:522

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:522
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:523
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:523
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:523

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:528

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:528
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:529
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:529
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:529

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:534

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:534
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:535
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:535
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:535

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:536

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:536
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:537
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:537
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:537

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:538

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:538
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:539
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:539
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:539

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:542

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:542
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:543
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:543
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:543

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:544

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:544
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:545
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:545
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:545

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:547

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:547
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:548
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:548
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:548

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:549

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:549
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:550
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:550
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:550

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:555

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:555
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:556
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:556
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:556

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:558

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:558
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:559
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:559
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:559

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:560

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:560
- /bin/sh
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:561
- /bin/bash
  sh -c "sysctl -n hw.ncpu"
  2⤵
  PID:561
- /usr/sbin/sysctl
  sysctl -n hw.ncpu
  2⤵
  PID:561

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact