T1547.007 Re-opened Applications

> Sub-technique of: T1547

High-Level Description

Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in". When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory. Applications listed in this file are automatically reopened upon the user’s next logon.

Adversaries can establish Persistence by adding a malicious application path to the <code>com.apple.loginwindow.UUID].plist</code> file to execute payloads when a user logs in.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS

What to Check

• ] Identify if Re-opened Applications technique is applicable to target environment
• ] Check macOS systems for indicators of Re-opened Applications
• ] Verify mitigations are bypassed or absent (2 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Copy in loginwindow.plist for Re-Opened Applications

Copy in new loginwindow.plist to launch Calculator.

Supported Platforms: macos

bash
cp #{calc_plist_path} ~/Library/Preferences/ByHost/com.apple.loginwindow.plist

Atomic Test 2: Re-Opened Applications using LoginHook

Mac Defaults

Reference

Supported Platforms: macos Elevation Required: Yes

bash
sudo defaults write com.apple.loginwindow LoginHook #{script}

Atomic Test 3: Append to existing loginwindow for Re-Opened Applications

Appends an entry to launch Calculator hidden loginwindow.\.plist for next login. Note that the change may not result in the added Calculator program launching on next user login. It may depend on which version of macOS you are running on.

Supported Platforms: macos

bash
FILE=`find ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist -type f | head -1`
if [ -z "${FILE}" ] ; then echo "No loginwindow plist file found" && exit 1 ; fi
echo save backup copy to /tmp/
cp ${FILE} /tmp/t1547007_loginwindow-backup.plist
echo before
plutil -p ${FILE}
echo overwriting...
#{exe_path} ${FILE} && echo after && plutil -p ${FILE}

Dependencies:

• compile C program

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Re-opened Applications by examining the target platforms (macOS).

1. Assess Existing Defenses: Review whether mitigations for T1547.007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1042 Disable or Remove Feature or Program

This feature can be disabled entirely with the following terminal command: <code>defaults write -g ApplePersistence -bool no</code>.

M1017 User Training

Holding the Shift key while logging in prevents apps from opening automatically.

Detection

Detect persistence via reopened application plist modification (macOS)

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------- | -------- | ----------- | | Re-opened Applications technique applicable | Low | Persistence |

CWE Categories

| CWE ID | Title | | ------- | ----------------------------- | | CWE-276 | Incorrect Default Permissions |

References

• Re-Open windows on Mac
• Methods of Mac Malware Persistence
• Wardle Persistence Chapter
• Atomic Red Team - T1547.007
• MITRE ATT&CK - T1547.007