drop launchagent or launchdaemon plist files · parse all · persistence map · flag suspicious · command extraction · runs locally
load plist bundle
Folder-aware drops preserve POSIX-ish paths so scopes classify correctly (~/Library/LaunchAgents, /Library/LaunchDaemons, /System/Library/LaunchDaemons). Scores combine RunAtLoad, KeepAlive, command primitives, paths, timers, env red flags, and Apple-label Levenshtein proximity.
Drop LaunchAgent/LaunchDaemon plists
.plist only · folder picks encouraged
drop LaunchAgents/LaunchDaemons · paths classify persistence scope