Startup Item File Created - MacOS

Status: test
Severity: low
Log source: category file_event, product macos
Author: Alejandro Ortuno, oscd.community
Source: github.com/SigmaHQ/sigma

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1037.005` Boot or Logon Initialization Scripts: Startup Items
Privilege Escalation	`T1037.005` Boot or Logon Initialization Scripts: Startup Items

Telemetry coverage

Platform	Record / event type
macOS	ESF event `create` (NOTIFY): Fires after a new filesystem object (file, directory, or special file) is created.

Rule body

title: Startup Item File Created - MacOS
id: dfe8b941-4e54-4242-b674-6b613d521962
status: test
description: |
    Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
    Adversaries may use startup items automatically executed at boot initialization to establish persistence.
    Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
    - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
author: Alejandro Ortuno, oscd.community
date: 2020-10-14
modified: 2024-08-11
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1037.005
logsource:
    category: file_event
    product: macos
detection:
    selection:
        TargetFilename|startswith:
            - '/Library/StartupItems/'
            - '/System/Library/StartupItems'
        TargetFilename|endswith: '.plist'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|startswith:
        - '/Library/StartupItems/'
        - '/System/Library/StartupItems'
    TargetFilename|endswith: '.plist'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.plist`	`field:"TargetFilename" kind:ends_with value:".plist"`
`TargetFilename`	starts_with	`/Library/StartupItems/` `/System/Library/StartupItems`	`field:"TargetFilename" kind:starts_with`