Login items are applications, documents, folders or server connections that macOS launches when a user logs in. MITRE tracks their abuse as T1547.015, with Persistence and Privilege Escalation as the tactics and macOS as the platform.
How attackers use it
MITRE describes two ways a login item gets created, and they behave differently.
- Shared file list items can be set with scripting languages such as AppleScript. They are visible in System Preferences, can hide the application when it launches, and are run through LaunchServices rather than launchd.
- Service Management Framework items use the API call
SMLoginItemSetEnabled. They use launchd, are not visible in System Preferences, and can only be removed by the application that created them.
Adversaries can use AppleScript and native API calls to create a login item that spawns a malicious executable. On macOS before 10.5, AppleScript could send Apple events to the System Events process, which holds a dictionary for editing login items. MITRE notes that this adds the path to a list file under ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.
Login items can also launch executables that control the system remotely, or help gain privileges by prompting for user credentials.
How to detect it
MITRE's detection strategy points at several artifacts.
- File creation or modification of
backgrounditems.btm. - New executables in
Contents/Library/LoginItems/inside app bundles. - Use of the
SMLoginItemSetEnabledAPI. - Suspicious processes that start after login without any user action.
The behavioral pivots are anomalous Apple events, odd parent and child process pairs, and login-triggered execution chains.
How to reduce the risk
MITRE states this technique cannot be easily mitigated with preventive controls, because it abuses a system feature. That makes inventory the main defense. Keep a list of expected login items per role, and review what a device actually has against it.
Check your own environment
Read-only commands for macOS Terminal. The first lists the background task management records on current macOS versions, and the second lists per-user launch agents.
sfltool dumpbtm
ls -la ~/Library/LaunchAgents
Look for items you cannot tie to an application you installed, especially ones that point to user writable folders.
Quick check
Why are Service Management Framework login items harder for a user to spot?
They are not visible in System Preferences, and only the application that created them can remove them.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Login Items: https://attack.mitre.org/techniques/T1547/015
