Technique T1036
Masquerading
Detection & mitigation
Monitor for suspicious LaunchAgent plist creation or modification, especially in user LaunchAgents directories. Detect Python processes spawned by unexpected binaries or making network connections to known malicious infrastructure. Use endpoint detection to identify Rust-based binaries with unusual behavior.