Techniques › T1037 › T1037.005
T1037.005 Startup Items
persistence · privilege escalation — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1037.005
0
KEV CVEs mapped here
<p>Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.</p><p>This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory.</p><p>An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism. Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0429 Detect Modification of macOS Startup Items v1.0
AN1197 macOSDetects the modification or addition of Launch Agents or Startup Items to establish persistence. Adversaries may write plist or executable files to ~/Library/LaunchAgents/, /Library/StartupItems/, or similar directories and configure them to run at user or system boot. Detection requires correlating file creation or modification events with subsequent user logon or boot-time process execution.Tunable:
directory_pathuser_contexttime_windowprocess_name
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1037.005
Author: Alejandro Ortuno, oscd.community
· 2020-10-14 (modified 2024-08-11) · logsource: product=macos category=file_event · dfe8b941-4e54-4242-b674-6b613d521962
Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.