cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

macOS LaunchDaemon's that keep running

Description: macOS LaunchDaemon's

What The Data Shows: Find every macOS LaunchDaemon that launches an executable and keeps it running

SQL:

SELECT name, program || program_arguments AS executable
  FROM launchd
  WHERE (run_at_load = 1 AND keep_alive = 1)
  AND (program != '' OR program_arguments != ''); 

 Source: https://github.com/osquery/osquery

1 Comment
Community Manager
Community Manager
Status changed to: Approved

Thank you for your continued contributions, @stympanick !!