MITRE ATT&CKsub-technique

T1037.005 Startup Items

Published 2020-01-15 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
macOS
Version
1.1
Created
2020-01-15

Description

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism. Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1037 Boot or Logon Initialization Scripts technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0283 jRAT software (malware)

Referenced by Compliance · mitigates (7)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References