ATT&CK technique
View on MITRE ATT&CK →
T1037.005
Startup Items
PersistencePrivilege Escalation
3 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious StartupItem Plist Creation | production | 2026-09-18 |
| splunk | Linux File Creation In System Generator Directory | production | 2026-07-08 |
| sigma | Startup Item File Created - MacOS | test | 2024-08-11 |