Objective See
products malware blog about
Block Blocking Login Items
parsing apple's login item files to detect persistence
07/23/2018
There are many ways for code to persist on macOS. One way for applications to persist and thus be automatically
launched when the user logs in, is to register as a 
login item
.
In the context of this blog post, "persistence" is defined as a way for a binary or application to 'register'
with the OS in order to be automatically executed when the system is rebooted (and/or when the user
logs in).
There are two 'types' of login items:
traditional
modern/sandboxed
Traditional login items are the focus of this blog post (specifically how to programmatically detect when new login item is
added). These are the items one can see in UI of the 
System Preferences
 application (under 
Users & Groups
, 
Login Items
):
On the other hand, 'modern' login items, are designed to work with applications distributed via the Mac App Store.
Found within the 
/Library/loginItems
 directory of application bundles, though they may be persistent and thus
automatically launched by the OS, a list of such items do not show up in UI.
Luckily KnockKnock will enumerate such login items for you:
© 2018 objective-see llc support us!  ✉
Aloha!
Sign up for our newsletter and
notifications about new tools &
blog posts?
Email Address
Subscribe
https://objective-see.com/blog/blog_0x31.html
Page 1 of 1