Resumed Application on Reboot¶
Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine.
| id: | 491db9c2-8b06-4076-8f9b-de44b9bae8d0 |
|---|---|
| categories: | enrich |
| confidence: | low |
| os: | macos |
| created: | 7/26/2019 |
| updated: | 7/26/2019 |
MITRE ATT&CK™ Mapping¶
| tactics: | Persistence |
|---|---|
| techniques: | T1164 Re-opened Applications |
Query¶
file where file_name == "*Library/Preferences/com.apple.loginwindow.*plist"