T1037.005sub-technique of T1037 Boot or Logon Initialization Scripts

Startup Items

macOSnothing on this site yetT1037.005 on attack.mitre.org

Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Modification of macOS Startup Items

Detects the modification or addition of Launch Agents or Startup Items to establish persistence. Adversaries may write plist or executable files to ~/Library/LaunchAgents/, /Library/StartupItems/, or similar directories and configure them to run at user or system boot.

what reduces it

M1022 Restrict File and Directory Permissions. Since StartupItems are deprecated, preventing all users from writing to the `/Library/StartupItems` directory would prevent any startup items from getting registered.

the rest of T1037

T1037.001 Logon Script (Windows) · not covered yet
T1037.002 Login Hook · not covered yet
T1037.003 Network Logon Script · not covered yet
T1037.004 RC Scripts · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.