T1547.007 — Re-opened Applications

Tactics: Persistence, Privilege Escalation · Platforms: macOS

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.007 Boot or Logon Autostart Execution: Re-opened Applications

title: "T1547.007 Boot or Logon Autostart Execution: Re-opened Applications"
id: f9187550-c8e6-4022-9ba4-4d21762ef8db
description: 'Detect persistence via reopened application plist modification (macOS). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, FilePathPattern, TimeWindow, BinaryAnomalyScore.'
references:
  - https://attack.mitre.org/techniques/T1547/007
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/open'
  selection_args:
    CommandLine|contains: '-a'
  selection_context:
    ParentImage|endswith: '/loginwindow'

  condition: selection and selection_args and selection_context

falsepositives:
  - The reopen-windows-at-login feature legitimately relaunches every application that was open at logout, so this should be scoped to relaunched applications that are unsigned or reside outside the standard Applications directory.

level: medium

Related sub-techniques

Explore