macOS Startup Item Plist Created in StartupItems Folders
Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.
- Product
- macos
- Category
- file_event
- Author
- Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-14
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies the creation of a macOS startup item plist file within the StartupItems directories under /Library or /System. Startup items are executed during boot to establish persistence, so unauthorized creation of these plist files can indicate attempted persistence via system startup configuration. It relies on file creation telemetry capturing the TargetFilename path and extension, matching *.plist under the specified directories.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
- developer.apple.comhttps://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Startup Item Plist Created in StartupItems Folders
id: 67fc2aff-2688-4ffb-95b9-e1e76ca8a5be
status: test
description: This rule identifies the creation of a macOS startup item plist file within the StartupItems directories under /Library or /System. Startup items are executed during boot to establish persistence, so unauthorized creation of these plist files can indicate attempted persistence via system startup configuration. It relies on file creation telemetry capturing the TargetFilename path and extension, matching *.plist under the specified directories.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
- https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-14
modified: 2024-08-11
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1037.005
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|startswith:
- /Library/StartupItems/
- /System/Library/StartupItems
TargetFilename|endswith: .plist
condition: selection
falsepositives:
- Legitimate administration activities
level: low
license: DRL-1.1
related:
- id: dfe8b941-4e54-4242-b674-6b613d521962
type: derived