Analytics BIOC Informational
✕

Uncommon login item persistency was registered or modified

An uncommon login item persistence mechanism was registered/modified on the system.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution (T1547) Boot or Logon Autostart Execution: Login Items (T1547.015)
Detector tags: Generic Persistence Analytics
Attacker's goals:

Establish persistent access to the compromised host by registering malicious code.

Investigative actions:

Analyze the persistency item and determine whether it performs any malicious or suspicious actions. Analyze the registered process and determine whether it performs any malicious or suspicious actions. Check the events generated by the process for potential malicious behavior.

Test period:
N/A (single event)
Deduplication:
1 Day
4 variations:
  • Uncommon login item persistency was registered or modified by a security testing tool High (parent: Informational)
  • Uncommon login item persistency was registered or modified while using osascript Low (parent: Informational) Adds Command and Scripting Interpreter (T1059)
  • Uncommon login item persistency was registered or modified by an invalidly signed actor process Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)
  • Uncommon login item persistency was registered or modified by an invalidly signed causality process Low (parent: Informational) Adds Masquerading: Masquerade Task or Service (T1036.004)