We use Patricks Wardle's utility BlockBlock to notify us of attempts to install Startup Items/Launch Daemons etc. It behaves sort of like LittleSnitch, except it doesn't monitor the network, it monitors for attempts to install certain types of files.
Today, shortly after booting-up our High Sierra machine we received an alert from BlockBlock about an attempt to install a launch daemon at /System/Library/LaunchDaemons/com.apple.MRTd.plist for /System/Library/CoreServices/MRT.app/Contents/MacOS/MRT
I'm assuming that this is related to a silent update to the MRT.app by Apple but don't recall ever experiencing this particular scenario.
Are others seeing this MRTd activity?