Potential Persistence via Login Hook

 1[metadata]
 2creation_date = "2021/01/21"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to
13run a program during system boot or user login for persistence.
14"""
15from = "now-9m"
16index = ["auditbeat-*", "logs-endpoint.events.*"]
17language = "kuery"
18license = "Elastic License v2"
19name = "Potential Persistence via Login Hook"
20note = """## Triage and analysis
21
22Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. This can be abused to establish or maintain persistence on a compromised system."""
23references = ["https://github.com/D00MFist/PersistentJXA/blob/master/LoginScript.js"]
24risk_score = 47
25rule_id = "ac412404-57a5-476f-858f-4e8fbb4f48d8"
26severity = "medium"
27tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Elastic Defend"]
28timestamp_override = "event.ingested"
29type = "query"
30
31query = '''
32event.category:file and host.os.type:macos and not event.type:"deletion" and
33 file.name:"com.apple.loginwindow.plist" and
34 process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or "iMazing Profile Editor"
35))
36'''
37
38
39[[rule.threat]]
40framework = "MITRE ATT&CK"
41[[rule.threat.technique]]
42id = "T1547"
43name = "Boot or Logon Autostart Execution"
44reference = "https://attack.mitre.org/techniques/T1547/"
45
46
47[rule.threat.tactic]
48id = "TA0003"
49name = "Persistence"
50reference = "https://attack.mitre.org/tactics/TA0003/"
51[[rule.threat]]
52framework = "MITRE ATT&CK"
53[[rule.threat.technique]]
54id = "T1647"
55name = "Plist File Modification"
56reference = "https://attack.mitre.org/techniques/T1647/"
57
58
59[rule.threat.tactic]
60id = "TA0005"
61name = "Defense Evasion"
62reference = "https://attack.mitre.org/tactics/TA0005/"