TA0003 · PERSISTENCE
Startup Items
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Detect it with
The /Library/StartupItems folder can be monitored for changes. Similarly, the programs that are actually executed from this mechanism should be checked against a whitelist.
Why it matters on shift
Startup Items is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context