tfMITRE ATT&CK sub-technique

Login Hook T1037.002

sub-technique of T1037 Boot or Logon Initialization Scripts

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 2.0
Created: 10 January 2020
Last modified: 24 October 2025

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1037.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2026 Q2

Login Hook detection strategy DET0244

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Login Hook Persistence on macOS

Enterprise

1 platform

AN0682 · macOS

Detection of persistent login hooks configured via defaults or plist modifications that result in execution of scripts or binaries at user login, breaking expected parent-child process lineage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	loginwindow or tccd-related entries
File ModificationDC0061	fs:plist	/var/root/Library/Preferences/com.apple.loginwindow.plist

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
login_hook_path	Path of script or binary assigned to login hook; may vary by environment
user_context	Login hook may be applied to specific user accounts; tune by privilege level
time_window	Correlate plist file modification to execution within a short timeframe
parent_process_name	Expected parent process (e.g., loginwindow); anomalies can indicate masquerading

Tests1Executorsmanual 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformsmacos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Logon Scripts - Mac	macos	manual	—	—	—
Mac logon script Attack command No command — this test is a manual procedure. GUIDf4dcada0-44d2-48b2-a54c-7c25ad95e0e9

Tests from Atomic Red Team (MIT licence) · technique definition

Login Hook detections T1037.002

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs