Login Items
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The technique is macOS-only and the single analytic AN0340 offers exactly four log sources, all of them {product: macos, service: unifiedlog} — post-login child of launchd/loginwindow, modification of backgrounditems.btm or a LoginItems subdirectory, invocation of SMLoginItemSetEnabled, and AppleScript creating a login item via the System Events dictionary. That logsource has no field vocabulary to write against. Not in the brief, whose log-source entries are prose notes with no field names anywhere. Not in lib/sigma, where scripts/mitre/logsource.mjs passes every macOS family straight through as {product: macos, service: } and translate.ts carries no macOS field map, so nothing downstream knows what a field on that source is called. […]
What the technique is
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in. Login items can be added via a shared file list or Service Management Framework. Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled. Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them. Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder. Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications. Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables. Prior to version 10.5 on macOS, adversaries can add login items by using AppleScript to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0340
Creation or modification of Login Items using AppleScript or Service Management Framework. Detection focuses on file creation/modification of backgrounditems.btm, new executables in Contents/Library/LoginItems/, use of SMLoginItemSetEnabled API, or suspicious processes triggered post-login without user interaction. Behavioral pivot includes anomalous AppleEvents, suspicious parent-child process pairs, and login-triggered execution chains.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.