{"id":"T1037.002","name":"Login Hook","url":"https://attack.mitre.org/techniques/T1037/002","tactics":["persistence","privilege-escalation"],"platforms":["macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0244","stix_id":"x-mitre-detection-strategy--6aa65bd1-4c0c-4bf7-ba74-ba0d8edd9cb9","name":"Detection Strategy for Login Hook Persistence on macOS","url":"https://attack.mitre.org/detectionstrategies/DET0244","analytics":[{"id":"AN0682","stix_id":"x-mitre-analytic--7a424183-94ca-4dc1-a03b-610d174aa973","name":"Analytic 0682","description":"Detection of persistent login hooks configured via defaults or plist modifications that result in execution of scripts or binaries at user login, breaking expected parent-child process lineage.","url":"https://attack.mitre.org/detectionstrategies/DET0244#AN0682","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"loginwindow or tccd-related entries","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:plist","channel":"/var/root/Library/Preferences/com.apple.loginwindow.plist","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-plist"}],"mutable_elements":[{"field":"login_hook_path","description":"Path of script or binary assigned to login hook; may vary by environment"},{"field":"user_context","description":"Login hook may be applied to specific user accounts; tune by privilege level"},{"field":"time_window","description":"Correlate plist file modification to execution within a short timeframe"},{"field":"parent_process_name","description":"Expected parent process (e.g., loginwindow); anomalies can indicate masquerading"}],"live":true,"detection_strategies":["DET0244"],"techniques":["T1037.002"]}],"live":true,"version":"1.0","techniques":["T1037.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}