Startup Items
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The technique is macOS-only and the brief's single analytic AN1197 offers exactly two log sources, macos:unifiedlog (launchservices/loginwindow) and macos:fsevents (/Library/StartupItems/, ~/Library/LaunchAgents/). Neither has a standardised Sigma field vocabulary: there is no agreed field name for the written path on macos:fsevents and none for the process or message on macos:unifiedlog, so any selection would be invented field names, which is the silent failure AUTHORING.md rule 1 and 2 exist to prevent — the rule would parse, render in four backends and match nothing. Writing it against the Sysmon-shaped file_event/macos category with TargetFilename instead would be inventing a logsource the brief does not contain, which rule 1 forbids outright. […]
Covered instead by T1037, T1037.004, T1543.001, T1543.004, T1546.004, T1087.001.
What the technique is
Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism. Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1197
Detects the modification or addition of Launch Agents or Startup Items to establish persistence. Adversaries may write plist or executable files to ~/Library/LaunchAgents/, /Library/StartupItems/, or similar directories and configure them to run at user or system boot. Detection requires correlating file creation or modification events with subsequent user logon or boot-time process execution.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.