tfMITRE ATT&CK sub-technique

Startup Items T1037.005

sub-technique of T1037 Boot or Logon Initialization Scripts

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.1
Created: 15 January 2020
Last modified: 24 October 2025

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Startup Items MITRE reference T1037.005

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

jRATS0283 ↗

Can list and manage startup entries.1

created 2018-10-17MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1037.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1

first rule: 2020 Q4

Startup Items detection strategy DET0429

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Modification of macOS Startup Items

Enterprise

1 platform

AN1197 · macOS

Detects the modification or addition of Launch Agents or Startup Items to establish persistence. Adversaries may write plist or executable files to ~/Library/LaunchAgents/, /Library/StartupItems/, or similar directories and configure them to run at user or system boot. Detection requires correlating file creation or modification events with subsequent user logon or boot-time process execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launchservices or loginwindow events
File CreationDC0039	macos:fsevents	/Library/StartupItems/, ~/Library/LaunchAgents/

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
directory_path	Specific paths to monitor may differ across macOS versions or enterprise baselines.
user_context	Different users may have unique LaunchAgents folders—tuning may be required.
time_window	The correlation time between file creation and process execution may need to be adjusted for boot persistence.
process_name	Specific startup binaries (e.g., bash, osascript) may vary across implementations.

Restrict File and Directory PermissionsM1022

Since StartupItems are deprecated, preventing all users from writing to the /Library/StartupItems directory would prevent any startup items from getting registered.

Tests3Executorsbash 2 · sh 1Need elevation3 of 3Have prerequisites2Have cleanup3Platformsmacos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Add file to Local Library StartupItems

macos

Required

—

Yes

Add launch script to launch daemon

macos

bash

Required

Yes

Add launch script to /Library/StartupItems to launch agent Example

Input arguments

Name	Type	Default	Description
path_startup_params	string	$PathToAtomicsFolder/T1037.005/src/StartupParameters.plist	Name of plist with startup params
path_malicious_plist	string	$PathToAtomicsFolder/T1037.005/src/T1037_005_daemon.plist	Name of file to store in /tmp
path_malicious_script	string	$PathToAtomicsFolder/T1037.005/src/T1037.005_daemon.sh	Name of script to store in cron folder

Attack command

sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_daemon.plist
sudo /Library/StartupItems/atomic.sh start

Cleanup command

sudo launchctl unload /tmp/T1037_005_daemon.plist
sudo rm /tmp/T1037_005_daemon.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_daemon.txt

Prerequisite

/Library/StartupItems must exist

Check

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Satisfy

echo "Failed to create /Library/StartupItems"; exit 1;

Prerequisite

The shared library must exist on disk at specified location (#{path_malicious_plist})

Check

if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;

Satisfy

echo "The plist file doesn't exist. Check the path and try again."; exit 1;

Prerequisite

The startup script must exist on disk at specified location (#{path_malicious_script})

Check

if [ -f #{path_malicious_script} ]; then exit 0; else exit 1; fi;

Satisfy

echo "The startup script doesn't exist. Check the path and try again."; exit 1;

GUID753be2e2-f11a-4aaa-aa6a-63fa8aca64ac

Add launch script to launch agent

macos

bash

Required

Yes

Add launch script to /Library/StartupItems to launch agent Example

Input arguments

Name	Type	Default	Description
path_startup_params	string	$PathToAtomicsFolder/T1037.005/src/StartupParameters.plist	Name of plist with startup params
path_malicious_plist	string	$PathToAtomicsFolder/T1037.005/src/T1037_005_agent.plist	Name of file to store in /tmp
path_malicious_script	string	$PathToAtomicsFolder/T1037.005/src/T1037.005_agent.sh	Name of script to store in cron folder

Attack command

sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_agent.plist
/Library/StartupItems/atomic.sh start

Cleanup command

sudo launchctl unload /tmp/T1037_005_agent.plist
sudo rm /tmp/T1037_005_agent.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_agent.txt

Prerequisite

/Library/StartupItems must exist

Check

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Satisfy

echo "Failed to create /Library/StartupItems"; exit 1;

Prerequisite

The shared library must exist on disk at specified location (#{path_malicious_plist})

Check

if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;

Satisfy

echo "The plist file doesn't exist. Check the path and try again."; exit 1;

Prerequisite

The startup script must exist on disk at specified location (#{path_malicious_script})

Check

if [ -f #{path_malicious_script} ]; then exit 0; else exit 1; fi;

Satisfy

echo "The startup script doesn't exist. Check the path and try again."; exit 1;

GUID9efe71f0-09ca-492c-9f51-05c1e441692c

Tests from Atomic Red Team (MIT licence) · technique definition

Startup Items detections T1037.005

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs