T1547.015 — Login Items
Tactics: Persistence, Privilege Escalation · Platforms: macOS
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in. Login items can be added via a shared file list or Service Management…
Sub-technique of Boot or Logon Autostart Execution (T1547).
Sigma detection rules (1)
T1547.015 Boot or Logon Autostart Execution: Login Items
title: "T1547.015 Boot or Logon Autostart Execution: Login Items"
id: bcd6a722-ce63-4654-9c7e-9c038877d5e3
description: 'Detection Strategy for T1547.015 – Login Items on macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, ExecutableAllowlist, PathRegexExclusion.'
references:
- https://attack.mitre.org/techniques/T1547/015
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.015
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- '/osascript'
selection_args:
CommandLine|contains:
- 'System Events'
- 'login item'
condition: selection and selection_args
falsepositives:
- Legitimate applications register themselves as login items through the same System Events AppleScript API during first-run onboarding, so this should be scoped to unsigned applications or scripts run outside a normal installer flow.
level: medium
Related sub-techniques
Explore