atomic-red-team/atomics/T1037.005/T1037.005.md

T1037.005 - Boot or Logon Initialization Scripts: Startup Items

Description from ATT&CK

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)

This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Source

Atomic Tests

• Atomic Test #1: Add file to Local Library StartupItems
• Atomic Test #2: Add launch script to launch daemon
• Atomic Test #3: Add launch script to launch agent

Atomic Test #1: Add file to Local Library StartupItems

Modify or create an file in /Library/StartupItems Reference

Supported Platforms: macOS

auto_generated_guid: 134627c3-75db-410e-bff8-7a920075f198

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo touch /Library/StartupItems/EvilStartup.plist

Cleanup Commands

sudo rm /Library/StartupItems/EvilStartup.plist

Atomic Test #2: Add launch script to launch daemon

Add launch script to /Library/StartupItems to launch agent Example

Supported Platforms: macOS

auto_generated_guid: fc369906-90c7-4a15-86fd-d37da624dde6

Inputs

Name	Description	Type	Default Value
path_malicious_script	Name of script to store in cron folder	string	$PathToAtomicsFolder/T1037.005/src/T1037.005_daemon.sh
path_malicious_plist	Name of file to store in /tmp	string	$PathToAtomicsFolder/T1037.005/src/T1037_005_daemon.plist
path_startup_params	Name of plist with startup params	string	$PathToAtomicsFolder/T1037.005/src/StartupParameters.plist

Attack Commands: Run with bash! Elevation Required (e.g. root or admin)

sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_daemon.plist
sudo /Library/StartupItems/atomic.sh start

Cleanup Commands

sudo launchctl unload /tmp/T1037_005_daemon.plist
sudo rm /tmp/T1037_005_daemon.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_daemon.txt

Dependencies: Run with bash!

Description: /Library/StartupItems must exist

Check Prereq Commands

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Get Prereq Commands

echo "Failed to create /Library/StartupItems"; exit 1;

Description: The shared library must exist on disk at specified location (#{path_malicious_plist})

Check Prereq Commands

if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;

Get Prereq Commands

echo "The plist file doesn't exist. Check the path and try again."; exit 1;

Description: The startup script must exist on disk at specified location (#{path_malicious_script})

Check Prereq Commands

if [ -f #{path_malicious_script} ]; then exit 0; else exit 1; fi;

Get Prereq Commands

echo "The startup script doesn't exist. Check the path and try again."; exit 1;

Atomic Test #3: Add launch script to launch agent

Add launch script to /Library/StartupItems to launch agent Example

Supported Platforms: macOS

auto_generated_guid: 10cf5bec-49dd-4ebf-8077-8f47e420096f

Inputs

Name	Description	Type	Default Value
path_malicious_script	Name of script to store in cron folder	string	$PathToAtomicsFolder/T1037.005/src/T1037.005_agent.sh
path_malicious_plist	Name of file to store in /tmp	string	$PathToAtomicsFolder/T1037.005/src/T1037_005_agent.plist
path_startup_params	Name of plist with startup params	string	$PathToAtomicsFolder/T1037.005/src/StartupParameters.plist

Attack Commands: Run with bash! Elevation Required (e.g. root or admin)

sudo cp #{path_startup_params} /Library/StartupItems/StartupParameters.plist
sudo cp #{path_malicious_script} /Library/StartupItems/atomic.sh
sudo cp #{path_malicious_plist} /tmp/T1037_005_agent.plist
/Library/StartupItems/atomic.sh start

Cleanup Commands

sudo launchctl unload /tmp/T1037_005_agent.plist
sudo rm /tmp/T1037_005_agent.plist
sudo rm /Library/StartupItems/atomic.sh
sudo rm /Library/StartupItems/StartupParameters.plist
sudo rm /tmp/T1037_005_agent.txt

Dependencies: Run with bash!

Description: /Library/StartupItems must exist

Check Prereq Commands

if [ ! -d /Library/StartupItems ]; then mkdir /Library/StartupItems; exit 0; fi;

Get Prereq Commands

echo "Failed to create /Library/StartupItems"; exit 1;

Description: The shared library must exist on disk at specified location (#{path_malicious_plist})

Check Prereq Commands

if [ -f #{path_malicious_plist} ]; then exit 0; else exit 1; fi;

Get Prereq Commands

echo "The plist file doesn't exist. Check the path and try again."; exit 1;

Description: The startup script must exist on disk at specified location (#{path_malicious_script})

Check Prereq Commands

if [ -f #{path_malicious_script} ]; then exit 0; else exit 1; fi;

Get Prereq Commands

echo "The startup script doesn't exist. Check the path and try again."; exit 1;