macOS LaunchDaemon's that keep running

[stympanick]

Description: macOS LaunchDaemon's

What The Data Shows: Find every macOS LaunchDaemon that launches an executable and keeps it running

SQL:

SELECT name, program || program_arguments AS executable
  FROM launchd
  WHERE (run_at_load = 1 AND keep_alive = 1)
  AND (program != '' OR program_arguments != ''); 

 Source: https://github.com/osquery/osquery

[esullivan]

Thank you for your continued contributions, @stympanick !!