Cross-source coverage
T1204.005 / ATT&CK
User Execution: Malicious Library
1 rule across 1 source.
From MITRE ATT&CK 19.2
Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.
In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.
- Tactics
- Execution
- Platforms
- Linux · macOS · Windows
- Telemetry
-
auditd:SYSCALLauditd:PATHNSM:FlowWinEventLog:Sysmonmacos:unifiedlog
How MITRE says to detect it DET0252
User-Initiated Malicious Library Installation via Package Manager (T1204.005)
Linux Analytic 0698
User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications. Defender sees `pip install` or `npm install` commands run by a non-root user, followed shortly by new `.py`, `.sh`, or `.js` files in hidden directories, or interpreter-based execution during boot/login.
auditd:SYSCALLexecve: Execution of pip, npm, gem, or similar package managersauditd:PATHNew .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package installNSM:Flowhttp::request: Network connection to package registry or C2 from interpreter shortly after install
Windows Analytic 0699
Execution of `pip.exe`, `npm.cmd`, or MSI installers within user context, followed by script interpreter startup (e.g., python.exe) or PowerShell with unusual child processes or file writes in `%APPDATA%`, `%TEMP%`, or `%LOCALAPPDATA%`. Defender correlates command-line install tools with Sysmon and Event Logs to trace downstream behavior.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11
macOS Analytic 0700
Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains. Defender links Terminal commands to plist creation, unsigned binary launches, and `python3` or `node` processes connecting to remote endpoints.
macos:unifiedlogCommand line invocation of pip3, brew install, npm install from interactive Terminalmacos:unifiedlogCreation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/NSM:FlowOutbound HTTP/S initiated by newly installed interpreter process
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Node.js Pre or Post-Install Script Execution | Medium | Elastic TOML |