tfMITRE ATT&CK sub-technique

Login Items T1547.015

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: macOS
Version: 1.1
Created: 05 October 2021
Last modified: 24 October 2025

Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.[1] Login items can be added via a shared file list or Service Management Framework.[2] Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Login Items MITRE reference T1547.015

57th pctamong all ATT&CK techniques for number of tools

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Green LambertS0690 ↗

Can add Login Items to establish persistence.1 2

created 2022-03-21MALWARE

DokS0281 ↗

Uses AppleScript to install a login Item by sending Apple events to the System Events process.1

created 2018-10-17MALWARE

NETWIRES0198 ↗

Can persist via startup options for Login items.1

created 2018-04-18MALWAREcarried by 4 groups

All 3 software entries for this technique

Offense vs defense T1547.015

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2023 Q3

Login Items detection strategy DET0121

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1547.015 – Login Items on macOS

Enterprise

1 platform

AN0340 · macOS

Creation or modification of Login Items using AppleScript or Service Management Framework. Detection focuses on file creation/modification of backgrounditems.btm, new executables in Contents/Library/LoginItems/, use of SMLoginItemSetEnabled API, or suspicious processes triggered post-login without user interaction. Behavioral pivot includes anomalous AppleEvents, suspicious parent-child process pairs, and login-triggered execution chains.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	Invocation of SMLoginItemSetEnabled by non-system or recently installed application
Script ExecutionDC0029	macos:unifiedlog	AppleScript creating login item via 'System Events' dictionary
Process CreationDC0032	macos:unifiedlog	Post-login execution of unrecognized child process from launchd or loginwindow
File ModificationDC0061	macos:unifiedlog	Modification of backgrounditems.btm or creation of LoginItems subdirectory in .app bundle

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate file and process activity within a defined interval post-login (e.g., 0–5 minutes)
UserContext	Distinguish between system users, interactive users, and daemon contexts
ExecutableAllowlist	Define known-good login items to suppress false positives
PathRegexExclusion	Exclude common enterprise paths (e.g., Jamf, MDM-managed apps)

Tests2ExecutorsPowerShell 1 · bash 1Need elevation0 of 2Have prerequisites1Have cleanup2Platformswindows, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Persistence by modifying Windows Terminal profile windows PowerShell — 1 Yes

Modify Windows Terminal settings.json file to gain persistence. Twitter Post

Input arguments

Name	Type	Default	Description
wt_exe	path	~\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe	Windows Terminal executable.
calculator	string	calculator.exe	Test program used to imitate a maliciously called program.
settings_json_def	path	~\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json	Default file for Windows Terminal to replace the default profile with a backdoor to call another program.
settings_json_tmp	path	~\AppData\Local\Temp\settings.json	Temp file for Windows Terminal.

Attack command

mv #{settings_json_def} #{settings_json_tmp}
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.015/src/settings.json?raw=true" -OutFile "#{settings_json_def}"
wt.exe

Cleanup command

mv -Force #{settings_json_tmp} #{settings_json_def}
taskkill /F /IM "#{calculator}" > $null

Prerequisite

Windows Terminal must be installed

Check

if (Test-Path #{wt_exe}) {exit 0} else {exit 1}

Satisfy

$(rm ~\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\StoreEdgeFD\installed.db -ErrorAction Ignore; Write-Output ""; $?) -and $(winget install --id=Microsoft.WindowsTerminal)

GUIDc7788e7d-98bc-4e92-889e-fda056202e67

02 Add macOS LoginItem using Applescript macos bash — — Yes

Runs osascript on a file to create new LoginItem for current user. NOTE: Will popup dialog prompting user to Allow or Deny Terminal.app to control "System Events" Therefore, it can't be automated until the TCC is granted. The login item launches Safari.app when user logs in, but there is a cleanup script to remove it as well. In addition to the osascript Process Events, file modification events to /Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm should be seen.

Input arguments

Name	Type	Default	Description
scriptfile	string	PathToAtomicsFolder/T1547.015/src/add_login_item.osa	path to Applescript source to add Safari LoginItem.
cleanup_script	string	PathToAtomicsFolder/T1547.015/src/remove_login_item.osa	path to Applescript source to delete Safari LoginItem.

Attack command

osascript #{scriptfile}

Cleanup command

osascript #{cleanup_script}

GUID3923ebe6-5eac-4824-a34b-32f219645924

Tests from Atomic Red Team (MIT licence) · technique definition

Login Items detections T1547.015

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs