Startup Items is ATT&CK T1037.005. It is mapped to Persistence and Privilege Escalation and applies to macOS.
How attackers use it
MITRE explains that startup items run during the final phase of the macOS boot process. Each contains shell scripts or other executables, plus configuration information the system uses to decide the order. A startup item is a directory whose executable and a property list called StartupParameters.plist sit in its top level.
The mechanism is technically deprecated, replaced by Launch Daemons, so the folder /Library/StartupItems is not guaranteed to exist. MITRE notes it does appear to exist by default on macOS Sierra. An adversary can create the right folders and files there to register their own persistence. Since startup items run during boot, they run as the elevated root user.
How to detect it
The MITRE analytic covers the modification or addition of Launch Agents or Startup Items. Adversaries may write plist or executable files to ~/Library/LaunchAgents, /Library/StartupItems and similar folders. The page says detection needs file creation or modification events to be correlated with the user logon or boot-time process execution that follows.
How to reduce the risk
MITRE lists one mitigation. Since startup items are deprecated, preventing all users from writing to /Library/StartupItems stops any startup item from being registered.
Check your own environment
Look for the folder and its contents. Absent or empty is the expected state on most systems:
ls -la /Library/StartupItems 2>/dev/null
Anything in there needs an owner and a reason. Also check the Launch Agents and Launch Daemons folders, since MITRE ties the same analytic to them.
