T1547.007No distinct observable

Re-opened Applications

Persistence · Privilege EscalationmacOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The single analytic AN0349 offers three log sources that resolve to two Sigma logsources, {product: macos, service: unifiedlog} (twice) and {product: macos, service: endpointsecurity}, and neither has a field vocabulary to write against. Not in the brief, whose source notes are prose — 'Execution of process launched via loginwindow session restore', 'LoginWindow context with associated PID linked to reopened plist paths', 'es_event_file_rename_t or es_event_file_write_t' — with no field names and no eventIds anywhere. Not in lib/sigma: scripts/mitre/logsource.mjs lines 237-244 pass every macOS family straight through as {product: macos, service: } with the note 'macOS log', and translate.ts carries no macOS field map, so nothing downstream knows what a field on either source is called; across 530 technique directories in this corpus not one rule.yml uses product: macos, verifiable with g […]

Covered instead by T1543.001, T1037.002, T1546.014.

What the technique is

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory. Applications listed in this file are automatically reopened upon the user’s next logon. Adversaries can establish Persistence by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.

Read it on attack.mitre.org

What MITRE says you would watch

AN0349
Unusual modification or creation of loginwindow-related plist files in '~/Library/Preferences/ByHost' correlated with unauthorized application paths and execution upon login.