{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--43ba2b05-cf72-4b6c-8243-03a4aba41ee0",
  "created": "2020-01-10T16:01:15.995Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1037/002",
      "external_id": "T1037.002"
    },
    {
      "source_name": "Login Scripts Apple Dev",
      "description": "Apple. (2016, September 13). Customizing Login and Logout. Retrieved April 1, 2022.",
      "url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CustomLogin.html"
    },
    {
      "source_name": "LoginWindowScripts Apple Dev",
      "description": "Apple. (n.d.). LoginWindowScripts. Retrieved April 1, 2022.",
      "url": "https://developer.apple.com/documentation/devicemanagement/loginwindowscripts"
    },
    {
      "source_name": "Wardle Persistence Chapter",
      "description": "Patrick Wardle. (n.d.). Chapter 0x2: Persistence. Retrieved April 13, 2022.",
      "url": "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf"
    },
    {
      "source_name": "S1 macOs Persistence",
      "description": "Stokes, P. (2019, July 17). How Malware Persists on macOS. Retrieved March 27, 2020.",
      "url": "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-10-24T17:48:42.963Z",
  "name": "Login Hook",
  "description": "Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the <code>/Library/Preferences/com.apple.loginwindow.plist</code> file and can be modified using the <code>defaults</code> command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev) \n\nAdversaries can add or insert a path to a malicious script in the <code>com.apple.loginwindow.plist</code> file, using the <code>LoginHook</code> or <code>LogoutHook</code> key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)\n\n**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) ",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "persistence"
    },
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "privilege-escalation"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "macOS"
  ],
  "x_mitre_version": "2.0"
}