kevmap

Techniques › T1547 › T1547.007

T1547.007 Re-opened Applications

persistence · privilege escalation — macOS · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1547.007
0
KEV CVEs mapped here
<p>Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory. Applications listed in this file are automatically reopened upon the user’s next logon.</p><p>Adversaries can establish Persistence by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.007

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1547) 7

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Startup/Logon Script Added to Group Policy Object mediumtest
Author: Elastic, Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Techniques: T1484.001T1547
Registry Persistence Mechanisms in Recycle Bin hightest
Author: frack113 · 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167
Detects persistence registry keys for Recycle Bin
Techniques: T1547
Atbroker Registry Change mediumtest
Author: Mateusz Wydra, oscd.community · 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Techniques: T1218T1547
Suspicious Driver Install by pnputil.exe mediumtest
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger · 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Techniques: T1547
Potential RipZip Attack on Startup Folder hightest
Author: Greg (rule) · 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Techniques: T1547
WINEKEY Registry Modification hightest
Author: omkar72 · 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5
Detects potential malicious modification of run keys by winekey or team9 backdoor
Techniques: T1547
Suspicious GrpConv Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
Techniques: T1547