Michael Haag
27 lines
570 B
Markdown
27 lines
570 B
Markdown
# Re-Opened Applications
|
|
|
|
MITRE ATT&CK Technique: [T1164](https://attack.mitre.org/wiki/Technique/T1164)
|
|
|
|
### Plist method
|
|
|
|
create a custom plist:
|
|
|
|
~/Library/Preferences/com.apple.loginwindow.plist
|
|
|
|
or
|
|
|
|
~/Library/Preferences/ByHost/com.apple.loginwindow.*.plist
|
|
|
|
### Mac Defaults
|
|
|
|
Create:
|
|
|
|
sudo defaults write com.apple.loginwindow LoginHook /path/to/script
|
|
|
|
Delete:
|
|
|
|
sudo defaults delete com.apple.loginwindow LoginHook
|
|
|
|
|
|
[Reference](https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html)
|