Login Items

{
  "id": "ATTACK:enterprise:T1547.015",
  "title": "Login Items",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1547/015",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--84601337-6a55-4ad7-9c35-79e0d1ea2ab3",
  "external_id": "T1547.015",
  "domain": "enterprise",
  "created": "2021-10-05T21:26:15.081Z",
  "modified": "2025-10-24T17:49:03.355Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Adding Login Items",
      "url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html"
    },
    {
      "source_name": "Launch Service Keys Developer Apple",
      "url": "https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW1"
    },
    {
      "source_name": "Launch Services Apple Developer",
      "url": "https://developer.apple.com/documentation/coreservices/launch_services"
    },
    {
      "source_name": "Login Items AE",
      "url": "https://developer.apple.com/library/archive/samplecode/LoginItemsAE/Introduction/Intro.html#//apple_ref/doc/uid/DTS10003788"
    },
    {
      "source_name": "Open Login Items Apple",
      "url": "https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac"
    },
    {
      "source_name": "hexed osx.dok analysis 2019",
      "url": "https://web.archive.org/web/20221007144948/http://www.hexed.in/2019/07/osxdok-analysis.html"
    },
    {
      "source_name": "ELC Running at startup",
      "url": "https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/"
    },
    {
      "source_name": "Startup Items Eclectic",
      "url": "https://eclecticlight.co/2021/09/16/how-to-run-an-app-or-tool-at-startup/"
    },
    {
      "source_name": "Add List Remove Login Items Apple Script",
      "url": "https://gist.github.com/kaloprominat/6111584"
    },
    {
      "source_name": "CheckPoint Dok",
      "url": "https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/"
    },
    {
      "source_name": "objsee block blocking login items",
      "url": "https://objective-see.com/blog/blog_0x31.html"
    },
    {
      "source_name": "objsee netwire backdoor 2019",
      "url": "https://objective-see.com/blog/blog_0x44.html"
    },
    {
      "source_name": "objsee mac malware 2017",
      "url": "https://objective-see.com/blog/blog_0x25.html"
    },
    {
      "source_name": "sentinelone macos persist Jun 2019",
      "url": "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
    },
    {
      "source_name": "SMLoginItemSetEnabled Schroeder 2013",
      "url": "https://web.archive.org/web/20160216034946/https://blog.timschroeder.net/2013/04/21/smloginitemsetenabled-demystified/"
    }
  ]
}