Sigma rule: Startup Item File Created - MacOS

Rule

Title

Startup Item File Created - MacOS

Status

test

Level

low

Author

Alejandro Ortuno, oscd.community

Date

2020-10-14

Modified

2024-08-11

File

rules/macos/file_event/file_event_macos_susp_startup_item_created.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Log source

product

macos

category

file_event

Detection

selection:
    TargetFilename|startswith:
        - '/Library/StartupItems/'
        - '/System/Library/StartupItems'
    TargetFilename|endswith: '.plist'
condition: selection

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1037.005

MITRE ATT&CK ids this rule names

• T1037.005

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
• https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/file_event/file_event_macos_susp_startup_item_created.yml