Detect Login Items in Google Chronicle

rule t1547_015_macos_login_items_persistence {
  meta:
    author = "df00tech"
    description = "Detects macOS Login Items persistence (T1547.015) via AppleScript/osascript System Events manipulation, sfltool login item additions, or file writes to Background Task Manager and Login Items paths"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1547.015"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1547/015/"
    platform = "macOS"
    created = "2026-04-20"

  events:
    (
      /* osascript or sfltool login item manipulation */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and $e.target.process.file.full_path = /\/usr\/bin\/(osascript|sfltool)/
        and (
          $e.target.process.command_line = /(?i)(login.?item|make.login.item|System.Events)/
          or ($e.target.process.command_line = /sfltool/ and $e.target.process.command_line = /(?i)(add|login)/)
        )
      )
      or
      /* System Events application handling login item requests */
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and $e.target.process.file.full_path = /System Events/
        and $e.target.process.command_line = /(?i)(login.?item|loginitem|LoginItem)/
      )
      or
      /* File creation/modification in login item paths */
      (
        $e.metadata.event_type = "FILE_CREATION"
        and (
          $e.target.file.full_path = /backgrounditems\.btm/
          or $e.target.file.full_path = /com\.apple\.backgroundtaskmanagementagent/
          or $e.target.file.full_path = /com\.apple\.loginitems/
          or $e.target.file.full_path = /Library\/Application Support\/com\.apple\.backgroundtaskmanagementagent/
        )
      )
    )

  condition:
    $e
}