القائمة
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1547-015-login-itemsيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | T1547.015_login-items |
| description | Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1547.015","persistence","privilege-escalation","macos","sub-technique"] |
| technique_id | T1547.015 |
| tactic | persistence |
| all_tactics |
| ["persistence","privilege-escalation"] |
| platforms | ["macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1547/015 |
| tech_stack | ["macos"] |
| cwe_ids | ["CWE-276"] |
| chains_with | ["T1547","T1547.001","T1547.002","T1547.003","T1547.004","T1547.005","T1547.006","T1547.007","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014"] |
| prerequisites | ["T1547"] |
| severity_boost | {"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"} |
Sub-technique of: T1547
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in. Login items can be added via a shared file list or Service Management Framework. Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them. Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder. Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.
Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables. Prior to version 10.5 on macOS, adversaries can add login items by using AppleScript to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items. Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable. This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm. Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.
Platforms: macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Runs osascript on a file to create new LoginItem for current user.
NOTE: Will popup dialog prompting user to Allow or Deny Terminal.app to control "System Events"
Therefore, it can't be automated until the TCC is granted.
The login item launches Safari.app when user logs in, but there is a cleanup script to remove it as well.
In addition to the osascript Process Events, file modification events to
/Users/*/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm should be seen.
Supported Platforms: macos
osascript #{scriptfile}
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Login Items by examining the target platforms (macOS).
Assess Existing Defenses: Review whether mitigations for T1547.015 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| Login Items technique applicable | High | Persistence |
| CWE ID | Title |
|---|---|
| CWE-276 | Incorrect Default Permissions |