Login Items

let LoginItemPaths = dynamic([
  "backgrounditems.btm",
  "com.apple.backgroundtaskmanagementagent",
  "com.apple.loginitems",
  "Library/Application Support/com.apple.backgroundtaskmanagementagent"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "System Events"
| where ProcessCommandLine has_any ("login item", "loginitem", "LoginItem")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "osascript" or ProcessCommandLine has "osascript"
| where ProcessCommandLine has_any ("login item", "System Events", "make login item")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc;
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (LoginItemPaths)
| where ActionType in ("FileCreated", "FileModified")
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sfltool" or ProcessCommandLine has "sfltool"
| where ProcessCommandLine has_any ("add", "login")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

index=macos sourcetype=osquery:results
  (name="login_items" OR name="startup_items")
| eval item_path=coalesce('columns.path', 'columns.Path')
| eval item_name=coalesce('columns.name', 'columns.Name')
| eval item_type=coalesce('columns.type', 'columns.Type')
| table _time, host, item_name, item_path, item_type
| sort - _time
| append
  [search index=macos sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (CommandLine="*login item*" OR CommandLine="*System Events*" OR CommandLine="*osascript*login*" OR CommandLine="*sfltool*")
  | table _time, host, User, Image, CommandLine, ParentImage
  | sort - _time]
| append
  [search index=macos sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    (TargetFilename="*backgrounditems.btm*" OR TargetFilename="*com.apple.loginitems*")
  | table _time, host, User, Image, TargetFilename
  | sort - _time]

any where host.os.type == "macos" and (
  (event.category == "process" and event.type == "start" and
   process.name == "osascript" and
   (process.command_line : "*login item*" or process.command_line : "*System Events*" or process.command_line : "*make login item*")) or
  (event.category == "process" and event.type == "start" and
   process.name == "System Events" and
   (process.command_line : "*login item*" or process.command_line : "*loginitem*" or process.command_line : "*LoginItem*")) or
  (event.category == "process" and event.type == "start" and
   process.name == "sfltool" and
   process.command_line : "*add*" and process.command_line : "*login*") or
  (event.category == "file" and
   event.action in ("creation", "modification") and
   (
     file.path : "*backgrounditems.btm*" or
     file.path : "*com.apple.backgroundtaskmanagementagent*" or
     file.path : "*com.apple.loginitems*" or
     file.path : "*/Library/Application Support/com.apple.backgroundtaskmanagementagent*"
   ))
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS "Event Time",
  LOGSOURCENAME(logsourceid) AS "Log Source",
  username AS "Username",
  sourceip AS "Source IP",
  QIDNAME(qid) AS "Event Name",
  "ProcessName" AS "Process Name",
  "CommandLine" AS "Command Line",
  "ParentProcessName" AS "Parent Process",
  "FilePath" AS "File Path"
FROM events
WHERE
  starttime > (CURRENT_TIMESTAMP - 86400000)
  AND (
    /* osascript login item via AppleScript / System Events */
    (
      ("ProcessName" ILIKE '%osascript%' OR "CommandLine" ILIKE '%osascript%')
      AND (
        "CommandLine" ILIKE '%login item%'
        OR "CommandLine" ILIKE '%System Events%'
        OR "CommandLine" ILIKE '%make login item%'
      )
    )
    /* System Events process with login item arguments */
    OR (
      "ProcessName" ILIKE '%System Events%'
      AND (
        "CommandLine" ILIKE '%login item%'
        OR "CommandLine" ILIKE '%loginitem%'
        OR "CommandLine" ILIKE '%LoginItem%'
      )
    )
    /* sfltool adding login items */
    OR (
      ("ProcessName" ILIKE '%sfltool%' OR "CommandLine" ILIKE '%sfltool%')
      AND "CommandLine" ILIKE '%add%'
      AND "CommandLine" ILIKE '%login%'
    )
    /* File creation/modification in login item paths */
    OR (
      "EventCategory" IN ('File Created', 'File Modified', 'File Written')
      AND (
        "FilePath" ILIKE '%backgrounditems.btm%'
        OR "FilePath" ILIKE '%com.apple.backgroundtaskmanagementagent%'
        OR "FilePath" ILIKE '%com.apple.loginitems%'
        OR "FilePath" ILIKE '%Application Support/com.apple.backgroundtaskmanagementagent%'
      )
    )
  )
ORDER BY starttime DESC

(_sourceCategory="macos*" OR _sourceCategory="endpoint/macos*" OR _sourceCategory="osquery*")
| where (
    /* osascript with login item or System Events */
    (%raw matches /osascript/ and (%raw matches /login.item/i or %raw matches /System.Events/i or %raw matches /make.login.item/i))
    /* System Events process handling login items */
    or (%raw matches /System Events/ and (%raw matches /loginitem/i or %raw matches /login item/i or %raw matches /LoginItem/))
    /* sfltool adding login items */
    or (%raw matches /sfltool/ and %raw matches /add/ and %raw matches /login/i)
    /* File creation in login item DB or plist paths */
    or (%raw matches /backgrounditems\.btm/ or %raw matches /com\.apple\.backgroundtaskmanagementagent/ or %raw matches /com\.apple\.loginitems/)
  )
| parse regex field=_raw "(?<process_name>[\w\-\.]+)\[(?<pid>\d+)\]" nodrop
| parse regex field=_raw "(?i)user[=:\s]+(?<username>[\w\-\.@]+)" nodrop
| parse regex field=_raw "(?i)host[=:\s]+(?<hostname>[\w\-\.]+)" nodrop
| parse regex field=_raw "(?i)(?:cmdline|CommandLine|command)[=:\s]+(?<command_line>.+?)(?:\||$|\n)" nodrop
| parse regex field=_raw "(?i)(?:path|filepath|FilePath)[=:\s]+(?<file_path>[^\s|]+)" nodrop
| fields _messagetime, hostname, username, process_name, pid, command_line, file_path
| sort by _messagetime desc

rule t1547_015_macos_login_items_persistence {
  meta:
    author = "df00tech"
    description = "Detects macOS Login Items persistence (T1547.015) via AppleScript/osascript System Events manipulation, sfltool login item additions, or file writes to Background Task Manager and Login Items paths"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1547.015"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1547/015/"
    platform = "macOS"
    created = "2026-04-20"

  events:
    (
      /* osascript or sfltool login item manipulation */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and $e.target.process.file.full_path = /\/usr\/bin\/(osascript|sfltool)/
        and (
          $e.target.process.command_line = /(?i)(login.?item|make.login.item|System.Events)/
          or ($e.target.process.command_line = /sfltool/ and $e.target.process.command_line = /(?i)(add|login)/)
        )
      )
      or
      /* System Events application handling login item requests */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and $e.target.process.file.full_path = /System Events/
        and $e.target.process.command_line = /(?i)(login.?item|loginitem|LoginItem)/
      )
      or
      /* File creation/modification in login item paths */
      (
        $e.metadata.event_type = "FILE_CREATION"
        and (
          $e.target.file.full_path = /backgrounditems\.btm/
          or $e.target.file.full_path = /com\.apple\.backgroundtaskmanagementagent/
          or $e.target.file.full_path = /com\.apple\.loginitems/
          or $e.target.file.full_path = /Library\/Application Support\/com\.apple\.backgroundtaskmanagementagent/
        )
      )
    )

  condition:
    $e
}

// T1547.015 - macOS Login Items Persistence
// Detection 1: osascript/System Events login item creation or sfltool manipulation
#event_simpleName = "ProcessRollup2"
| OperatingSystemVersion = /[Mm]ac/
| (
    (FileName = /osascript/ and CommandLine = /(?i)(login.?item|make.login.item|System.Events)/)
    or (FileName = /sfltool/ and CommandLine = /(?i)add/ and CommandLine = /(?i)login/)
    or (CommandLine = /(?i)System.Events/ and CommandLine = /(?i)(login.?item|loginitem|LoginItem)/)
  )
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, SHA256HashData])
| sort(field=timestamp, order=desc)

// Detection 2: File write to Login Items / Background Task Manager paths
| union [
  #event_simpleName in ("PeFileWritten", "UnmanagedAssetWritten", "ScriptControlScanTelemetry")
  | OperatingSystemVersion = /[Mm]ac/
  | TargetFileName = /(?i)(backgrounditems\.btm|com\.apple\.backgroundtaskmanagementagent|com\.apple\.loginitems)/
  | table([timestamp, ComputerName, UserName, TargetFileName, FileName, CommandLine, SHA256HashData])
  | sort(field=timestamp, order=desc)
]