event.category:file and host.os.type:macos and not event.type:"deletion" and
file.name:"com.apple.loginwindow.plist" and
not process.name: (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or "iMazing Profile Editor" or storagekitd or CloneKitService)
Install detection rules in Elastic Security
Detect Potential Persistence via Login Hook in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).