# T1547.007 - Re-opened Applications
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1547/007)
<blockquote>Adversaries may modify plist files to automatically run an application when a user logs in. Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user logs into their machine after reboot. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at <code>~/Library/Preferences/com.apple.loginwindow.plist</code> and <code>~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist</code>. 

An adversary can modify one of these files directly to include a link to their malicious executable to provide a persistence mechanism each time the user reboots their machine (Citation: Methods of Mac Malware Persistence).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Re-Opened Applications](#atomic-test-1---re-opened-applications)

- [Atomic Test #2 - Re-Opened Applications](#atomic-test-2---re-opened-applications)


<br/>

## Atomic Test #1 - Re-Opened Applications
Plist Method

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)

**Supported Platforms:** macOS


**auto_generated_guid:** 5fefd767-ef54-4ac6-84d3-751ab85e8aba





#### Run it with these steps! 
1. create a custom plist:

    ~/Library/Preferences/com.apple.loginwindow.plist

or

    ~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist







<br/>
<br/>

## Atomic Test #2 - Re-Opened Applications
Mac Defaults

[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)

**Supported Platforms:** macOS


**auto_generated_guid:** 5f5b71da-e03f-42e7-ac98-d63f9e0465cb





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script | path to script | Path | /path/to/script|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo defaults write com.apple.loginwindow LoginHook #{script}
```

#### Cleanup Commands:
```sh
sudo defaults delete com.apple.loginwindow LoginHook
```





<br/>
