MBCProject-mbc-markdown/persistence/startup-items.md

ID	T1165
Objective(s)	Persistence, Privilege Escalation
Related ATT&CK Technique(s)	Startup Items

Startup Items

Malware may add an entry to the macOS StartupItems directory to enable persistence. Because StartupItems run during the bootup phase of macOS, they will run as root, enabling privilege escalation. [1]

See ATT&CK: Startup Items .

References