T1037.002sub-technique of T1037 Boot or Logon Initialization Scripts

Login Hook

macOSnothing on this site yetT1037.002 on attack.mitre.org

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the `/Library/Preferences/com.apple.loginwindow.plist` file and can be modified using the `defaults` command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detection Strategy for Login Hook Persistence on macOS

Detection of persistent login hooks configured via defaults or plist modifications that result in execution of scripts or binaries at user login, breaking expected parent-child process lineage.

what reduces it

M1022 Restrict File and Directory Permissions. Restrict write access to logon scripts to specific administrators.

the rest of T1037

T1037.001 Logon Script (Windows) · not covered yet
T1037.003 Network Logon Script · not covered yet
T1037.004 RC Scripts · not covered yet
T1037.005 Startup Items · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.