The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

macOS LaunchDaemon's that keep running

Description: macOS LaunchDaemon's

What The Data Shows: Find every macOS LaunchDaemon that launches an executable and keeps it running


SELECT name, program || program_arguments AS executable
  FROM launchd
  WHERE (run_at_load = 1 AND keep_alive = 1)
  AND (program != '' OR program_arguments != ''); 


1 Comment
Carbon Black Employee
Status changed to: Approved

Thank you for your continued contributions, @stympanick !!