t1037-002-login-hook

name	T1037.002_login-hook
description	Adversaries may use a Login Hook to establish persistence executed upon user logon.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1037.002","persistence","privilege-escalation","macos","sub-technique"]
technique_id	T1037.002
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["macOS"]
mitre_url	https://attack.mitre.org/techniques/T1037/002
tech_stack	["macos"]
cwe_ids	["CWE-276"]
chains_with	["T1037","T1037.001","T1037.003","T1037.004","T1037.005"]
prerequisites	["T1037"]
severity_boost	{"T1037":"Chain with T1037 for deeper attack path","T1037.001":"Chain with T1037.001 for deeper attack path","T1037.003":"Chain with T1037.003 for deeper attack path"}

T1037.002 Login Hook

Sub-technique of: T1037

High-Level Description

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.

Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.

Note: Login hooks were deprecated in 10.11 version of macOS in favor of Launch Daemon and Launch Agent

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• Identify if Login Hook technique is applicable to target environment
• Check macOS systems for indicators of Login Hook
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Logon Scripts - Mac

Mac logon script

Supported Platforms: macos

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Login Hook by examining the target platforms (macOS).

2. Assess Existing Defenses: Review whether mitigations for T1037.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.