Skip to content

Latest commit

 

History

History
41 lines (18 loc) · 2.66 KB

T1547.011.md

File metadata and controls

41 lines (18 loc) · 2.66 KB
Raw

T1547.011 - Plist Modification

Description from ATT&CK

Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges).

Adversaries can modify plist files to execute their code as part of establishing persistence. plists may also be used to elevate privileges since they may execute in the context of another user.(Citation: Sofacy Komplex Trojan)

A specific plist used for execution at login is com.apple.loginitems.plist.(Citation: Methods of Mac Malware Persistence) Applications under this plist run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them.(Citation: Adding Login Items) Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to "hide" the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like AppleScript can do this as well. (Citation: Adding Login Items)

Atomic Tests


Atomic Test #1 - Plist Modification

Modify MacOS plist file in one of two directories

Supported Platforms: macOS

Run it with these steps!

  1. Modify a .plist in

    /Library/Preferences

    OR

    ~/Library/Preferences

  2. Subsequently, follow the steps for adding and running via Launch Agent