t1037-005-startup-items

name	T1037.005_startup-items
description	Adversaries may use startup items automatically executed at boot initialization to establish persistence.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1037.005","persistence","privilege-escalation","macos","sub-technique"]
technique_id	T1037.005
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["macOS"]
mitre_url	https://attack.mitre.org/techniques/T1037/005
tech_stack	["macos"]
cwe_ids	["CWE-276"]
chains_with	["T1037","T1037.001","T1037.002","T1037.003","T1037.004"]
prerequisites	["T1037"]
severity_boost	{"T1037":"Chain with T1037 for deeper attack path","T1037.001":"Chain with T1037.001 for deeper attack path","T1037.002":"Chain with T1037.002 for deeper attack path"}

T1037.005 Startup Items

Sub-technique of: T1037

High-Level Description

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism. Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• Identify if Startup Items technique is applicable to target environment
• Check macOS systems for indicators of Startup Items
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Add file to Local Library StartupItems

Modify or create an file in /Library/StartupItems Reference

Supported Platforms: macos Elevation Required: Yes

sudo touch /Library/StartupItems/EvilStartup.plist

Atomic Test 2: Add launch script to launch daemon

Add launch script to /Library/StartupItems to launch agent Example