Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named <code>com.apple.loginwindow.[UUID].plist</code> within the <code>~/Library/Preferences/ByHost</code> directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon.

Adversaries can establish [Persistence](https://attack.mitre.org/tactics/TA0003) by adding a malicious application path to the <code>com.apple.loginwindow.[UUID].plist</code> file to execute payloads when a user logs in.
Re-opened Applications
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1547/007  external_id: T1547.007     source_name: Re-Open windows on Mac  description: Apple. (2016, December 6). Automatically re-open windows, apps, and documents on your Mac. Retrieved July 11, 2017.  url: https://support.apple.com/en-us/HT204005     source_name: Methods of Mac Malware Persistence  description: Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.  url: https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf     source_name: Wardle Persistence Chapter  description: Patrick Wardle. (n.d.). Chapter 0x2: Persistence. Retrieved April 13, 2022.  url: https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf     