القائمة
Adversaries may modify plist files to automatically run an application when a user logs in.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1547-007-re-opened-applicationsيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | T1547.007_re-opened-applications |
| description | Adversaries may modify plist files to automatically run an application when a user logs in. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1547.007","persistence","privilege-escalation","macos","sub-technique"] |
| technique_id | T1547.007 |
| tactic | persistence |
| all_tactics | ["persistence","privilege-escalation"] |
| platforms | ["macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1547/007 |
| tech_stack | ["macos"] |
| cwe_ids | ["CWE-276"] |
| chains_with | ["T1547","T1547.001","T1547.002","T1547.003","T1547.004","T1547.005","T1547.006","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014","T1547.015"] |
| prerequisites | ["T1547"] |
| severity_boost | {"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"} |
Sub-technique of: T1547
Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory. Applications listed in this file are automatically reopened upon the user’s next logon.
Adversaries can establish Persistence by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.
Platforms: macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Copy in new loginwindow.plist to launch Calculator.
Supported Platforms: macos
cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist
Mac Defaults
Supported Platforms: macos Elevation Required: Yes
sudo defaults write com.apple.loginwindow LoginHook
Appends an entry to launch Calculator hidden loginwindow.*.plist for next login. Note that the change may not result in the added Calculator program launching on next user login. It may depend on which version of macOS you are running on.
Supported Platforms: macos
FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then echo "No loginwindow plist file found" && exit 1 ; fi
echo save backup copy to /tmp/
cp ${FILE} /tmp/t1547007_loginwindow-backup.plist
echo before
plutil -p ${FILE}
echo overwriting...
#{exe_path} ${FILE} && echo after && plutil -p ${FILE}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Re-opened Applications by examining the target platforms (macOS).
Assess Existing Defenses: Review whether mitigations for T1547.007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no.
Holding the Shift key while logging in prevents apps from opening automatically.
| Finding | Severity | Impact |
|---|---|---|
| Re-opened Applications technique applicable | Low | Persistence |
| CWE ID | Title |
|---|---|
| CWE-276 | Incorrect Default Permissions |