BEYOND THE GOOD OL' LAUNCHAGENTS - PERSIST THROUGH THE NVRAM

Summary from the TLDR InfoSec newsletter

This post is part of a series that explores unique ways to achieve persistence on macOS via methods that don't use the traditional LauchDaemons or LaunchAgents. The author discovered an unused IO registry key called apple-trusted-trampoline in the IODeviceTree:/options entry (corresponding to the NVRAM) which is executed during the boot task if the rc.trampoline flag is set. They note that this is not a practical attack as it requires SIP to be disabled among other limitations.