Detect Re-opened Applications in Elastic Security
Adversaries may modify plist files to automatically run an application when a user logs in on macOS. When a user logs out or restarts via the macOS GUI, a prompt with a checkbox to 'Reopen windows when logging back in' causes all currently open applications to be added to a property list file named com.apple.loginwindow.[UUID].plist within ~/Library/Preferences/ByHost/. Adversaries can establish persistence by adding a malicious application path to this plist file to execute payloads when a user logs in.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1547 Boot or Logon Autostart Execution
- Sub-technique
- T1547.007 Re-opened Applications
- Canonical reference
- https://attack.mitre.org/techniques/T1547/007/
Elastic Detection Query
file where host.os.type == "macos" and event.action in ("creation", "modification") and file.name like "com.apple.loginwindow.*" and file.path like "*/Library/Preferences/ByHost/*"Detects creation or modification of com.apple.loginwindow plist files in the macOS ByHost preferences directory, which adversaries can use to establish persistence by adding malicious application paths that execute at user login.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macOS session restore behavior when users log out with 'Reopen windows when logging back in' checkbox enabled
- System preference management tools or MDM solutions (Jamf, Mosyle) modifying login window preferences during policy enforcement
- macOS system updates or OS upgrades that regenerate loginwindow plist files during upgrade process
Other platforms for T1547.007
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Application to Loginwindow Plist via defaults
Expected signal: File modification event for com.apple.loginwindow plist. Process creation for defaults command with the write arguments.
- Test 2Read Current Loginwindow Plist
Expected signal: Process creation event for plutil. No file modification events.
- Test 3Modify Loginwindow Plist via AppleScript
Expected signal: Process creation for osascript. File modification event for loginwindow plist. The osascript parent process is a strong indicator.
References (5)
- https://attack.mitre.org/techniques/T1547/007/
- https://support.apple.com/en-us/HT204005
- https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
- https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.007/T1547.007.md
Unlock Pro Content
Get the full detection package for T1547.007 including response playbook, investigation guide, and atomic red team tests.