T1547.007 Re-opened Applications — Attack Simulation

Technique description

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory. Applications…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Re-Opened Applications using LoginHook
  macosautomatedsh

  Procedure 5f5b71da-e03f-42e7-ac98-d63f9e0465cb; elevation required; cleanup present, not reviewed. Not executed or individually validated.

• Copy in loginwindow.plist for Re-Opened Applications
  macosautomatedsh

  Procedure 5fefd767-ef54-4ac6-84d3-751ab85e8aba; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Append to existing loginwindow for Re-Opened Applications
  macosautomatedsh

  Procedure 766b6c3c-9353-4033-8b7e-38b309fa3a93; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.