Boot or Logon Initialization Scripts: Startup Items
- ID
- T1037.005
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1037 Boot or Logon Initialization Scripts
- Platforms
- macOS
- Data sources
- Process Creation, File Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.[1]
This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.
An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.[2] Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Detection
- DET0429 Detect Modification of macOS Startup Items
Data components: Process Creation, File Creation
Mitigations (1)
- M1022 Restrict File and Directory Permissions
Since StartupItems are deprecated, preventing all users from writing to the
/Library/StartupItemsdirectory would prevent any startup items from getting registered.