value:  The malware achieves persistence by placing its script (and a StartupParameters.plist) in a sub-directory in either the /System/Library/StartupItems or /Library/StartupItems directory. 
name: Boot or Logon Initialization Scripts: Startup Items