Techniques › T1037.005 › AN1197
AN1197 Analytic 1197
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects the modification or addition of Launch Agents or Startup Items to establish persistence. Adversaries may write plist or executable files to ~/Library/LaunchAgents/, /Library/StartupItems/, or similar directories and configure them to run at user or system boot. Detection requires correlating file creation or modification events with subsequent user logon or boot-time process execution.</p>
- Detects
- T1037.005 Startup Items
- Part of
- DET0429 Detect Modification of macOS Startup Items
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | launchservices or loginwindow events | DC0032 Process Creation |
| macos:fsevents | /Library/StartupItems/, ~/Library/LaunchAgents/ | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
directory_path | Specific paths to monitor may differ across macOS versions or enterprise baselines. |
user_context | Different users may have unique LaunchAgents folders—tuning may be required. |
time_window | The correlation time between file creation and process execution may need to be adjusted for boot persistence. |
process_name | Specific startup binaries (e.g., bash, osascript) may vary across implementations. |