macOS Startup Item Plist Created in StartupItems Directories

title: macOS Startup Item Plist Created in StartupItems Directories
id: 67fc2aff-2688-4ffb-95b9-e1e76ca8a5be
status: test
description: This rule flags file creation events for macOS startup item property list files located under /Library/StartupItems or /System/Library/StartupItems. Startup item plists can be used for persistence because they are processed during the boot sequence to run configured scripts or executables. The detection relies on file event telemetry that records the created file path, specifically matching directory prefixes and a .plist suffix.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
  - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2024-08-11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.005
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|startswith:
      - /Library/StartupItems/
      - /System/Library/StartupItems
    TargetFilename|endswith: .plist
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: dfe8b941-4e54-4242-b674-6b613d521962
    type: derived