t1547-007-re-opened-applications

name	T1547.007_re-opened-applications
description	Adversaries may modify plist files to automatically run an application when a user logs in.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1547.007","persistence","privilege-escalation","macos","sub-technique"]
technique_id	T1547.007
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["macOS"]
mitre_url	https://attack.mitre.org/techniques/T1547/007
tech_stack	["macos"]
cwe_ids	["CWE-276"]
chains_with	["T1547","T1547.001","T1547.002","T1547.003","T1547.004","T1547.005","T1547.006","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014","T1547.015"]
prerequisites	["T1547"]
severity_boost	{"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"}

T1547.007 Re-opened Applications

Sub-technique of: T1547

High-Level Description

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory. Applications listed in this file are automatically reopened upon the user’s next logon.

Adversaries can establish Persistence by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• Identify if Re-opened Applications technique is applicable to target environment
• Check macOS systems for indicators of Re-opened Applications
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Copy in loginwindow.plist for Re-Opened Applications

Copy in new loginwindow.plist to launch Calculator.

Supported Platforms: macos

cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist

Atomic Test 2: Re-Opened Applications using LoginHook

Mac Defaults

Reference

Supported Platforms: macos Elevation Required: Yes

sudo defaults write com.apple.loginwindow LoginHook