Login Item

MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them ¹. Users have direct control over login items installed using a shared file list which are also visible in System Preferences ². These login items are stored in the user's <code>~/Library/Preferences/</code> directory in a plist file called <code>com.apple.loginitems.plist</code> ³. Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in ^{4 5}. The API method <code> SMLoginItemSetEnabled </code> can be used to set Login Items, but scripting languages like AppleScript can do this as well ⁶.

1. Adding Login Items
2. Adding Login Items
3. Methods of Mac Malware Persistence
4. Malware Persistence on OS X
5. OSX.Dok Malware
6. Adding Login Items

使用该技术的组织

参考表中尚无组织使用记录。

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。