Re-opened Applications is a macOS persistence technique, tracked by MITRE as T1547.007. Its tactics are Persistence and Privilege Escalation, and the only platform listed is macOS.
It abuses a feature most people have clicked without thinking about: the "Reopen windows when logging back in" checkbox on the logout and restart prompt.
How attackers use it
When a user logs out or restarts through the GUI and ticks that box, macOS records the open applications in a property list file named com.apple.loginwindow.[UUID].plist in the ~/Library/Preferences/ByHost directory. Applications in that file are reopened at the next logon.
MITRE documents that an adversary can add a malicious application path to that plist. The payload then runs at login, which gives persistence without a LaunchAgent or a login item.
How to detect it
The MITRE detection strategy is narrow and useful. Watch for unusual creation or modification of loginwindow related plist files in ~/Library/Preferences/ByHost, and correlate that with execution of an application path you do not recognize at login.
A simple baseline helps. Those files change when users log out normally, so the signal is the content: an entry that points at an unexpected location, or a change made by something other than the login window process.
How to reduce the risk
MITRE lists two mitigations.
- Disable the feature entirely with
defaults write -g ApplePersistence -bool no. On managed fleets, push the equivalent setting through your device management tooling and test it first. - User training: holding the Shift key while logging in prevents applications from opening automatically.
Quick check
Where does macOS store the list of applications to reopen?
In a file named com.apple.loginwindow.[UUID].plist under ~/Library/Preferences/ByHost.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Re-opened Applications: https://attack.mitre.org/techniques/T1547/007
