Startup Items
Subtechnique · ATTACK:enterprise:T1037.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1037.005",
"title": "Startup Items",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1037/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--c0dfe7b0-b873-4618-9ff8-53e31f70907f",
"external_id": "T1037.005",
"domain": "enterprise",
"created": "2020-01-15T18:00:33.603Z",
"modified": "2025-10-24T17:49:19.678Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Startup Items",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"
},
{
"source_name": "Methods of Mac Malware Persistence",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
}
]
}Explicit source assertions (3)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27c0f853-f7b0-43e9-b980-7965d1227a9e
ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1037.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68f6cc6d-b90b-4a56-a867-99b3a2786b11
Kaspersky Adwind Feb 2016ATTACK:enterprise:T1037.005 → subtechnique-of → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89423e8b-a8bb-4658-88f7-70cd6912f61f