T1037.002 - Boot or Logon Initialization Scripts: Logon Script (Mac)

Description from ATT&CK

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter) **Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001)

Atomic Tests


Atomic Test #1 - Logon Scripts - Mac

Mac logon script

Supported Platforms: macOS

auto_generated_guid: f047c7de-a2d9-406e-a62b-12a09d9516f4

Run it with these steps!

  1. Create the required plist file

    sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist

  2. Populate the plist with the location of your shell script

    sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh

  3. Create the required plist file in the target user’s Preferences directory

    touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist

  4. Populate the plist with the location of your shell script

    defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh