T1037.002 — Login Hook

Tactics: Persistence, Privilege Escalation · Platforms: macOS

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be…

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Sigma detection rules (1)

T1037.002 Boot or Logon Initialization Scripts: Login Hook

title: "T1037.002 Boot or Logon Initialization Scripts: Login Hook"
id: feb81e8e-9622-453f-a92c-7973ba6a6d8c
description: 'Detection Strategy for Login Hook Persistence on macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: login_hook_path, user_context, time_window, parent_process_name.'
references:
  - https://attack.mitre.org/techniques/T1037/002
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/defaults'
    CommandLine|contains|all:
      - 'write'
      - 'com.apple.loginwindow'
      - 'LoginHook'
  condition: selection

falsepositives:
  - Legacy MDM configuration profiles or IT scripts that intentionally set login/logout hooks for compliance banners.

level: high

Related sub-techniques

Explore