Detect Startup Items in Splunk
Adversaries may use startup items automatically executed at boot initialization to establish persistence on macOS systems. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information (StartupParameters.plist) used by the system to determine execution order. Although technically deprecated in favor of Launch Daemons, the /Library/StartupItems directory may still exist on systems. An adversary can create the appropriate folders and files in the StartupItems directory to register their own persistence mechanism that executes as root during system boot.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Sub-technique
- T1037.005 Startup Items
- Canonical reference
- https://attack.mitre.org/techniques/T1037/005/
SPL Detection Query
index=mac_logs (sourcetype="jamf:pro" OR sourcetype="syslog" OR sourcetype="macos:unified_log" OR sourcetype="microsoft:defender:atp")
| eval event_type=coalesce(event_type, sourcetype)
| eval file_path=coalesce(file_path, FilePath, FolderPath, path, "")
| eval process_cmd=coalesce(process_cmd, CommandLine, ProcessCommandLine, cmdline, "")
| eval user=coalesce(user, AccountName, User, username, "")
| eval host_name=coalesce(host, DeviceName, hostname, "")
| where (match(file_path, "/Library/StartupItems"))
OR (match(process_cmd, "/Library/StartupItems"))
OR (match(file_path, "StartupParameters\\.plist"))
OR (match(process_cmd, "StartupParameters\\.plist"))
| eval IsPlistCreation=if(match(file_path, "StartupParameters\\.plist"), 1, 0)
| eval IsDirectoryCreation=if(match(process_cmd, "mkdir.*StartupItems"), 1, 0)
| eval IsChmod=if(match(process_cmd, "chmod.*StartupItems"), 1, 0)
| eval IsCopy=if(match(process_cmd, "cp.*StartupItems"), 1, 0)
| eval SuspicionScore=IsPlistCreation + IsDirectoryCreation + IsChmod + IsCopy
| table _time, host_name, user, file_path, process_cmd, IsPlistCreation, IsDirectoryCreation, IsChmod, IsCopy, SuspicionScore
| sort - _time
| union [
search index=mac_logs sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| where 1=0
]
| append [
search index=mac_logs (sourcetype="syslog" OR sourcetype="macos:unified_log")
("/Library/StartupItems" OR "StartupParameters.plist")
| eval file_path=coalesce(file_path, message, "")
| eval process_cmd=coalesce(process_cmd, cmdline, message, "")
| eval user=coalesce(user, username, "")
| eval host_name=coalesce(host, hostname, "")
| eval IsPlistCreation=if(match(file_path, "StartupParameters\\.plist") OR match(process_cmd, "StartupParameters\\.plist"), 1, 0)
| eval IsDirectoryCreation=if(match(process_cmd, "mkdir.*StartupItems"), 1, 0)
| eval IsChmod=if(match(process_cmd, "chmod.*StartupItems"), 1, 0)
| eval IsCopy=if(match(process_cmd, "cp.*StartupItems"), 1, 0)
| eval SuspicionScore=IsPlistCreation + IsDirectoryCreation + IsChmod + IsCopy
| where SuspicionScore > 0
| table _time, host_name, user, file_path, process_cmd, IsPlistCreation, IsDirectoryCreation, IsChmod, IsCopy, SuspicionScore
| sort - _time
]Detects macOS Startup Items persistence by searching across macOS log sourcetypes for file path references to /Library/StartupItems or StartupParameters.plist. Scores events by activity type (plist creation, directory creation, chmod, copy operations) and surfaces the highest-risk events. Designed for environments ingesting macOS syslog, Unified Log, Jamf Pro, or Microsoft Defender ATP macOS telemetry into Splunk.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate third-party macOS software installers that still use the deprecated StartupItems mechanism for compatibility with older macOS versions
- System administrators or IT teams manually creating startup items for legacy application compatibility
- macOS system updates or migration tools that read or restore /Library/StartupItems content from backups
- Security or monitoring software that scans /Library/StartupItems as part of system inventory or compliance checks
Other platforms for T1037.005
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Startup Item Directory and Plist
Expected signal: File creation events for /Library/StartupItems/AtomicTestItem/ (directory), /Library/StartupItems/AtomicTestItem/AtomicTestItem (shell script), and /Library/StartupItems/AtomicTestItem/StartupParameters.plist. Process creation events for mkdir, bash, chmod with command lines referencing /Library/StartupItems. macOS Unified Log entries for sudo usage. MDE DeviceFileEvents with FolderPath containing /Library/StartupItems and FileName=StartupParameters.plist.
- Test 2Deploy Startup Item with Network Callback Script
Expected signal: File creation events for /Library/StartupItems/UpdateHelper/ directory and contents. Process creation events for mkdir, bash, chmod with /Library/StartupItems path. The shell script content will contain 'curl' and a network callback URL visible in file content telemetry. Spotlight metadata (kMDItemWhereFroms) will be absent since file was created locally. MDE DeviceFileEvents entries for both the executable and StartupParameters.plist.
- Test 3Simulate Startup Item Execution via Shell
Expected signal: Process creation events: sudo, bash, and the AtomicExecTest script executing with root privileges. The FolderPath /Library/StartupItems/AtomicExecTest/ appears in both file creation and process execution events. The id and echo commands run as root (uid=0) are visible in child process telemetry. MDE DeviceProcessEvents entries show InitiatingProcessFileName=bash with FolderPath containing /Library/StartupItems.
References (8)
- https://attack.mitre.org/techniques/T1037/005/
- https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- https://objective-see.org/blog.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.005/T1037.005.md
- https://www.kaspersky.com/blog/adwind-rat/11430/
- https://support.apple.com/guide/deployment/startup-items-dep7b3ee4a0e/web
- https://www.jamf.com/blog/how-malware-persists-on-macos/
Unlock Pro Content
Get the full detection package for T1037.005 including response playbook, investigation guide, and atomic red team tests.