tfMITRE ATT&CK sub-technique

Re-opened Applications T1547.007

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.2
Created: 24 January 2020
Last modified: 24 October 2025

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".[1] When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.[2][3] Applications listed in this file are automatically reopened upon the user’s next logon.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1547.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Re-opened Applications detection strategy DET0125

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect persistence via reopened application plist modification (macOS)

Enterprise

1 platform

AN0349 · macOS

Unusual modification or creation of loginwindow-related plist files in '~/Library/Preferences/ByHost' correlated with unauthorized application paths and execution upon login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of process launched via loginwindow session restore
File MetadataDC0059	macos:endpointsecurity	es_event_file_rename_t or es_event_file_write_t
File ModificationDC0061	fs:filesystem	Modification or creation of files matching 'com.apple.loginwindow.*.plist' in ~/Library/Preferences/ByHost
Logon Session MetadataDC0088	macos:unifiedlog	LoginWindow context with associated PID linked to reopened plist paths

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Restrict to targeted users or unexpected users writing to plist
FilePathPattern	Allow tuning for alternative persistence paths or directory redirection
TimeWindow	Correlate plist write and process execution within logon window
BinaryAnomalyScore	Optional scoring of launched binary based on code signing, entropy, and known safe apps

Disable or Remove Feature or ProgramM1042

This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no.

User TrainingM1017

Holding the Shift key while logging in prevents apps from opening automatically.

Tests3Executorssh 3Need elevation1 of 3Have prerequisites1Have cleanup3Platformsmacos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Copy in loginwindow.plist for Re-Opened Applications

macos

—

Yes

Copy in new loginwindow.plist to launch Calculator.

Input arguments

Name	Type	Default	Description
calc_plist_path	path	PathToAtomicsFolder/T1547.007/src/reopen_loginwindow_calc.plist	path to binary plist with entry to open calculator

Attack command

cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist

Cleanup command

rm -f ~/Library/Preferences/ByHost/com.apple.loginwindow.plist

GUIDfb7b6c46-c9ee-4766-b170-ad81dfa77807

Re-Opened Applications using LoginHook

macos

Required

—

Yes

Mac Defaults Reference

Input arguments

Name	Type	Default	Description
script	path	/path/to/script	path to script

Attack command

sudo defaults write com.apple.loginwindow LoginHook #{script}

Cleanup command

sudo defaults delete com.apple.loginwindow LoginHook

GUIDf35f3d47-a238-44b4-ab25-d1030fc9cabd

Append to existing loginwindow for Re-Opened Applications

macos

—

Yes

Appends an entry to launch Calculator hidden loginwindow.*.plist for next login. Note that the change may not result in the added Calculator program launching on next user login. It may depend on which version of macOS you are running on.

Input arguments

Name	Type	Default	Description
exe_path	path	/tmp/t1547007_append_exe	path to compiled program
objc_source_path	path	PathToAtomicsFolder/T1547.007/src/append_reopen_loginwindow.m	path to objective C program

Attack command

FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then echo "No loginwindow plist file found" && exit 1 ; fi
echo save backup copy to /tmp/
cp ${FILE} /tmp/t1547007_loginwindow-backup.plist
echo before
plutil -p ${FILE}
echo overwriting...
#{exe_path} ${FILE} && echo after && plutil -p ${FILE}

Cleanup command

rm -f #{exe_path}
# revert to backup copy
FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then
   exit 0
fi
mv /tmp/t1547007_loginwindow-backup.plist ${FILE}

Prerequisite

compile C program

Check

if [ -f "#{exe_path}" ]; then exit 0 ; else exit 1; fi

Satisfy

cc #{objc_source_path} -o #{exe_path} -framework Cocoa

GUIDd2a349da-1c65-45af-888d-508276d6b821

Tests from Atomic Red Team (MIT licence) · technique definition

Re-opened Applications detections T1547.007

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs