# T1165 - Startup Items
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1165)
<blockquote>Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. 

An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism (Citation: Methods of Mac Malware Persistence). Additionally, since StartupItems run during the bootup phase of macOS, they will run as root. If an adversary is able to modify an existing Startup Item, then they will be able to Privilege Escalate as well.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Startup Items](#atomic-test-1---startup-items)

- [Atomic Test #2 - Startup Items (emond rule)](#atomic-test-2---startup-items-emond-rule)


<br/>

## Atomic Test #1 - Startup Items
Modify or create an file in StartupItems

[Reference](https://www.alienvault.com/blogs/labs-research/diversity-in-recent-mac-malware)

**Supported Platforms:** macOS


#### Run it with these steps!
1. /Library/StartupItems/StartupParameters.plist


<br/>
<br/>

## Atomic Test #2 - Startup Items (emond rule)
Establish persistence via a rule run by emond daemon at startup, based on https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124

**Supported Platforms:** macOS


#### Inputs
| Name | Description | Type | Default Value | 
|------|-------------|------|---------------|
| plist | Path to emond plist file | path | /path/to/T1165_emond.plist|

#### Run it with `sh`!
```
sudo cp "#{plist}" /etc/emond.d/rules/T1165_emond.plist
sudo touch /private/var/db/emondClients/T1165
#Clean up
sudo rm /etc/emond.d/rules/T1165_emond.plist
sudo rm /private/var/db/emondClients/T1165
```
<br/>