Detect Login Items in Elastic Security
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in. Login items can be added via a shared file list or Service Management Framework. Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled. Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them. Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1547 Boot or Logon Autostart Execution
- Sub-technique
- T1547.015 Login Items
- Canonical reference
- https://attack.mitre.org/techniques/T1547/015/
Elastic Detection Query
any where host.os.type == "macos" and (
(event.category == "process" and event.type == "start" and
process.name == "osascript" and
(process.command_line : "*login item*" or process.command_line : "*System Events*" or process.command_line : "*make login item*")) or
(event.category == "process" and event.type == "start" and
process.name == "System Events" and
(process.command_line : "*login item*" or process.command_line : "*loginitem*" or process.command_line : "*LoginItem*")) or
(event.category == "process" and event.type == "start" and
process.name == "sfltool" and
process.command_line : "*add*" and process.command_line : "*login*") or
(event.category == "file" and
event.action in ("creation", "modification") and
(
file.path : "*backgrounditems.btm*" or
file.path : "*com.apple.backgroundtaskmanagementagent*" or
file.path : "*com.apple.loginitems*" or
file.path : "*/Library/Application Support/com.apple.backgroundtaskmanagementagent*"
))
)Detects macOS Login Items persistence (T1547.015) via AppleScript/osascript calls to System Events, sfltool login item manipulation, or direct file creation/modification in Background Task Management and Login Items paths. Covers both shared file list and Service Management Framework persistence vectors.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate application installers (e.g., Dropbox, Zoom, Slack) that register themselves as login items using AppleScript or SMLoginItemSetEnabled during first launch or setup
- macOS system utilities and preference management tools that programmatically modify login item configurations during OS updates or user profile migrations
- IT management platforms (Jamf Pro, Mosyle, Kandji) running osascript or sfltool as part of device enrollment, configuration baselines, or software provisioning workflows
- Developer tools and CI/CD agents (e.g., Xcode helper processes, build agents) that use System Events scripting for automation and test harness setup
Other platforms for T1547.015
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Login Item via AppleScript (Shared File List)
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'login item' and 'System Events'. File modification event on ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm. Unified Log entry in com.apple.backgroundtaskmanagement subsystem.
- Test 2Add Hidden Login Item via AppleScript
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'hidden:true'. File modification of backgrounditems.btm. Unified Log entry showing the hidden login item creation.
- Test 3Enumerate Login Items via AppleScript (Reconnaissance)
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'login item' and 'System Events'. No file modification events (read-only operation).
- Test 4Login Item via sfltool (Shared File List Tool)
Expected signal: Sysmon for macOS Event ID 1: Process Create for sfltool with CommandLine containing 'add-item' and the shared file list name. File modification of backgrounditems.btm. Unified Log entries for shared file list modifications.
References (9)
- https://attack.mitre.org/techniques/T1547/015/
- https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html
- https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac
- https://eclecticlight.co/2021/09/16/how-to-run-an-app-or-tool-at-startup/
- https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/
- https://objective-see.com/blog/blog_0x31.html
- https://objective-see.com/blog/blog_0x44.html
- https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.015/T1547.015.md
Unlock Pro Content
Get the full detection package for T1547.015 including response playbook, investigation guide, and atomic red team tests.