Boot or Logon Autostart Execution: Re-opened Applications
- ID
- T1547.007
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1547 Boot or Logon Autostart Execution
- Platforms
- macOS
- Data sources
- Process Creation, File Modification, Logon Session Metadata, File Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".[1] When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.[2][3] Applications listed in this file are automatically reopened upon the user’s next logon.
Adversaries can establish Persistence by adding a malicious application path to the com.apple.loginwindow.[UUID].plist file to execute payloads when a user logs in.
Detection
- DET0125 Detect persistence via reopened application plist modification (macOS)
Data components: Process Creation, File Modification, Logon Session Metadata, File Metadata
Mitigations (2)
- M1017 User Training
Holding the Shift key while logging in prevents apps from opening automatically.[1]
- M1042 Disable or Remove Feature or Program
This feature can be disabled entirely with the following terminal command:
defaults write -g ApplePersistence -bool no.