Login Hook is ATT&CK T1037.002. It is mapped to Persistence and Privilege Escalation and applies to macOS.
How attackers use it
MITRE describes a login hook as a plist entry that points to a script that runs with root privileges when a user logs on. The setting lives in /Library/Preferences/com.apple.loginwindow.plist and can be modified with the defaults command line utility. The same applies to logout hooks, where a script runs at logout. All hooks need administrator permissions to modify or create.
An adversary adds the path of a malicious script using the LoginHook or LogoutHook key. The script then runs at the next login. If a hook already exists, the adversary can add commands to it. There can be only one login hook and one logout hook on a system at a time. MITRE also notes that login hooks were deprecated in macOS 10.11 in favor of Launch Daemons and Launch Agents.
Deprecated does not mean gone. A mechanism that still works and that few people check is attractive for persistence.
How to detect it
The MITRE analytic looks for persistent login hooks configured through defaults or plist modifications that result in scripts or binaries running at login, breaking expected parent-child process lineage.
Useful data: file modification events for the loginwindow plist, process creation events from the defaults tool that name LoginHook or LogoutHook, and process creation at login time whose parent is the login window process but whose image is a shell script in an unusual folder.
How to reduce the risk
MITRE lists one mitigation: restrict file and directory permissions. Limit write access to logon scripts to specific administrators. Since there can be only one hook, any hook that your organization did not put there is a clear finding.
Check your own environment
Read the loginwindow settings and look for hook keys. This is read-only:
sudo defaults read /Library/Preferences/com.apple.loginwindow
If the output contains LoginHook or LogoutHook, find out who set it and what the script does. If neither key appears, there is no hook configured there.
Quick check
How many login hooks can a macOS system have?
One login hook and one logout hook at a time, per MITRE.
With what privileges does a login hook script run?
Root.
