atomic-red-team/Mac/Persistence/Re-opened_Applications.md

Re-Opened Applications

MITRE ATT&CK Technique: T1164

Plist method

create a custom plist:

~/Library/Preferences/com.apple.loginwindow.plist

or

~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist

Mac Defaults

Create:

sudo defaults write com.apple.loginwindow LoginHook /path/to/script

Delete:

sudo defaults delete com.apple.loginwindow LoginHook

Reference