Detect Login Items in Splunk
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in. Login items can be added via a shared file list or Service Management Framework. Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled. Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them. Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1547 Boot or Logon Autostart Execution
- Sub-technique
- T1547.015 Login Items
- Canonical reference
- https://attack.mitre.org/techniques/T1547/015/
SPL Detection Query
index=macos sourcetype=osquery:results
(name="login_items" OR name="startup_items")
| eval item_path=coalesce('columns.path', 'columns.Path')
| eval item_name=coalesce('columns.name', 'columns.Name')
| eval item_type=coalesce('columns.type', 'columns.Type')
| table _time, host, item_name, item_path, item_type
| sort - _time
| append
[search index=macos sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*login item*" OR CommandLine="*System Events*" OR CommandLine="*osascript*login*" OR CommandLine="*sfltool*")
| table _time, host, User, Image, CommandLine, ParentImage
| sort - _time]
| append
[search index=macos sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*backgrounditems.btm*" OR TargetFilename="*com.apple.loginitems*")
| table _time, host, User, Image, TargetFilename
| sort - _time]Detects macOS Login Items persistence using multiple data sources: (1) osquery login_items table for real-time inventory of all registered login items, (2) Sysmon for macOS Event ID 1 for process creation events involving osascript, System Events, or sfltool login item manipulation, and (3) Sysmon Event ID 11 for file creation events on the backgrounditems.btm file. The osquery source provides a comprehensive snapshot while Sysmon captures the modification in real-time.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate applications adding themselves to Login Items when users enable 'Open at Login'
- macOS system updates modifying the backgrounditems.btm shared file list
- MDM solutions (Jamf, Mosyle) deploying login items via configuration profiles
- Developers testing Login Item APIs during application development
Other platforms for T1547.015
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Login Item via AppleScript (Shared File List)
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'login item' and 'System Events'. File modification event on ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm. Unified Log entry in com.apple.backgroundtaskmanagement subsystem.
- Test 2Add Hidden Login Item via AppleScript
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'hidden:true'. File modification of backgrounditems.btm. Unified Log entry showing the hidden login item creation.
- Test 3Enumerate Login Items via AppleScript (Reconnaissance)
Expected signal: Sysmon for macOS Event ID 1: Process Create for osascript with CommandLine containing 'login item' and 'System Events'. No file modification events (read-only operation).
- Test 4Login Item via sfltool (Shared File List Tool)
Expected signal: Sysmon for macOS Event ID 1: Process Create for sfltool with CommandLine containing 'add-item' and the shared file list name. File modification of backgrounditems.btm. Unified Log entries for shared file list modifications.
References (9)
- https://attack.mitre.org/techniques/T1547/015/
- https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html
- https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac
- https://eclecticlight.co/2021/09/16/how-to-run-an-app-or-tool-at-startup/
- https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/
- https://objective-see.com/blog/blog_0x31.html
- https://objective-see.com/blog/blog_0x44.html
- https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1547.015/T1547.015.md
Unlock Pro Content
Get the full detection package for T1547.015 including response playbook, investigation guide, and atomic red team tests.