T1037.002No distinct observable

Login Hook

Persistence · Privilege EscalationmacOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The single analytic AN0682 offers exactly one Sigma logsource, {product: macos, service: unifiedlog}, and that logsource has no field vocabulary to write against. Not in the brief, whose only guidance is the prose note 'loginwindow or tccd-related entries' with no field names anywhere. Not in lib/sigma: scripts/mitre/logsource.mjs line 237 passes every macOS channel straight through as {product: macos, service: } with the note 'macOS log', so nothing downstream knows what a field on that source is called. And not in Sigma's own taxonomy, which models macOS process events as {category: process_creation, product: macos} with Image/CommandLine/ParentImage and has no unifiedlog service schema. No rule in this corpus uses macos/unifiedlog as a logsource for that reason. […]

Covered instead by T1037, T1059.002, T1548.004.

What the technique is

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks. Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time. **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of Launch Daemon and Launch Agent

Read it on attack.mitre.org

What MITRE says you would watch

AN0682
Detection of persistent login hooks configured via defaults or plist modifications that result in execution of scripts or binaries at user login, breaking expected parent-child process lineage.