Login Items Persistence is a persistence technique where malware or other unwanted software is configured to launch automatically at user logon. It uses operating system startup mechanisms, such as user login items, launch agents or equivalent autostart entries, to regain execution after reboot or sign-in.
What Login Items Persistence Means
Login items persistence is a common attacker persistence pattern, used to make unwanted software start automatically when a user signs in. It matters because the malware does not need to re-exploit the system every time, it simply waits for the next logon.
How Login Items Persistence Works
This technique abuses normal startup mechanisms rather than relying on a custom loader. On modern systems that can include login items, launch agents, Run-style entries, startup folders, or similar autostart features that are designed to help legitimate apps open at login.
Because the mechanism is ordinary, the malicious entry can blend into a busy endpoint. That makes it especially effective after an initial intrusion, when the attacker wants a low-noise way to regain execution and preserve access without dropping a visibly new service or daemon.
Why Login Items Persistence Is Effective for Attackers
Persistence at logon is attractive because it survives reboot, user logout, and many routine maintenance cycles. It is also flexible: the entry can launch in the context of a specific user, which may be enough to re-open a foothold, steal sessions, or stage follow-on activity.
On macOS, for example, login items and launch agents are part of the same broader autostart landscape that defenders must understand. T1547 Boot or Logon Autostart Execution Defensive Guide is useful background for the full set of autostart locations and the detection patterns that go with them.
How Defenders Find and Remove Login Items Persistence
Defenders usually start with inventory and comparison, then move to event data and endpoint tooling. The core question is simple: what is configured to run at logon, who put it there, and whether that entry is expected for this host and user.
Normal startup entries should be baselined so that new or unusual login items stand out. When malicious persistence is confirmed, removal should be paired with a review of the initial access path, because persistence often arrives after credential theft, phishing, or another compromise that may still be active.
For incident handling that focuses on identity-related persistence and follow-on abuse, Identity Threat Detection and Response (ITDR) Guide is a strong companion reference, and Salt Typhoon telecom intrusions 2025 shows how stolen access and persistence can reinforce each other over long periods.
What Good Defenders Watch For
Suspicious login-item persistence is often less about the file name and more about the relationship between the entry and the host. Unknown publishers, odd paths, recently created autostart entries, and startup objects pointing to user-writable locations are all worth attention.
Defenders should also look for the broader chain around the persistence point, especially anomalous sign-ins, unusual parent-child process relationships, and signs that the attacker is using the login item as a reliable re-entry path rather than as the only objective.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1547 — Boot or Logon Autostart Execution | This technique is an ATT&CK persistence pattern using logon autostart mechanisms. |
| Recommendation — Map suspicious startup entries to T1547 and hunt for autostart persistence across endpoints. | ||
| NIST SP 800-53 Rev 5 | CM-7 — Least Functionality | Autostart persistence exploits unnecessary startup behavior that least functionality should restrict. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing endpoint and sign-in activity for unexpected autostart changes. | |
| Recommendation — Limit unnecessary startup mechanisms and remove unapproved logon execution paths. Review audit and endpoint telemetry for new or altered logon persistence entries. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Persistent logon execution is surfaced through logging and review of endpoint activity. |
| CIS-17 — Incident Response Management | Malicious login items are typically handled as a persistence mechanism in incident response. | |
| Recommendation — Centralize and review logs that show creation or use of autostart entries. Treat unauthorized logon persistence as an incident and validate eradication before closure. | ||
Related resources from NHI Mgmt Group
- What breaks when macOS persistence items are only visible, not enforced?
- What happens when users create or edit login items without understanding clipboard side effects?
- What fails when attackers can turn a valid login into cloud persistence?
- What should security teams do when login items are created inconsistently?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org