Skip to content
Threat Feed
Subscribe
medium advisory

macOS Persistence via Login Hook plist Modification

Adversaries can achieve persistence on macOS by modifying 'com.apple.loginwindow.plist' to execute malicious scripts or binaries with root privileges via LoginHook or LogoutHook keys.

Triage facts

Revision 1
Applicability
macOS
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 2, 09:08 UTC
Detection
1 rule
Source quality
A1Likely

The com.apple.loginwindow preferences domain supports the deprecated LoginHook and LogoutHook keys, which allow for the execution of arbitrary scripts or binaries with root privileges every time a user logs in or out. Adversaries leverage these keys by writing to the com.apple.loginwindow.plist file, typically located in /var/root/Library/Preferences/, /Library/Preferences/, or ~/Library/Preferences/. This technique provides a mechanism for automatic execution during system boot or user login.

Impact

Successful exploitation allows for persistent execution of arbitrary code with root privileges upon every login or logout event on the affected macOS host.

Recommendation

  • Deploy file integrity monitoring to alert on any modification to com.apple.loginwindow.plist files across the environment.
  • Review all existing LoginHook and LogoutHook configurations on high-value macOS hosts using sudo plutil -p /var/root/Library/Preferences/com.apple.loginwindow.plist.
  • Validate modifications against expected configuration management, backup, and system migration activity.
  • Remove unauthorized hooks using sudo defaults delete com.apple.loginwindow LoginHook.

Immediate actions

Deploy file monitoring for com.apple.loginwindow.plist and alert on non-management processes

Detection Engineering 48h

Threat Hunt

Identify existing LoginHook or LogoutHook configurations using plutil

T1037.002 high high confidence hunt now

Data: Host-level file content inspection

Mitigations

Remove unauthorized LoginHook entries via 'sudo defaults delete com.apple.loginwindow LoginHook'

immediate SOC

T1037.002

Detection coverage 1

Detect macOS Persistence via Login Hook

medium

Detects creation or modification of com.apple.loginwindow.plist which may indicate a LoginHook or LogoutHook persistence mechanism.

sigma tactics: persistence techniques: T1037.002 sources: file_event, macos

Detection queries are available on the platform. Get full rules →