T1037.005 — Startup Items

Tactics: Persistence, Privilege Escalation · Platforms: macOS

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the…

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Sigma detection rules (1)

T1037.005 Boot or Logon Initialization Scripts: Startup Items

title: "T1037.005 Boot or Logon Initialization Scripts: Startup Items"
id: ec203182-ec1f-4f95-8b24-bb5b66c86922
description: 'Detect Modification of macOS Startup Items. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: directory_path, user_context, time_window, process_name.'
references:
  - https://attack.mitre.org/techniques/T1037/005
author: Shahrukh Khan
date: 2026-03-15
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.005

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/StartupItems/'
      - '/System/Library/StartupItems/'
  condition: selection

falsepositives:
  - Legacy administrative deployment tooling still relying on the deprecated StartupItems mechanism.

level: high

Related sub-techniques

Explore