Cross-source coverage

T1554 / ATT&CK

Compromise Host Software Binary

26 rules across 5 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.

Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process).

An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.

After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the yum-versionlock command or versionlock.list file in Linux systems that use the yum package manager).

Tactics
Persistence
Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLauditd:EXECVEmacos:unifiedlogesxi:hostdesxi:vmkernel

How MITRE says to detect it DET0336

Detect Compromise of Host Software Binaries

Windows Analytic 0949

Monitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=2
  • WinEventLog:Security EventCode=4688

Linux Analytic 0950

Detects modification of system or application binaries by monitoring /usr/bin, /bin, and other privileged directories. Correlates file integrity monitoring (FIM) events with unexpected process executions or service restarts.

  • auditd:SYSCALL open, write
  • auditd:EXECVE execve

macOS Analytic 0951

Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.

  • macos:unifiedlog binary modified or replaced
  • macos:unifiedlog execution of modified binary without valid signature

ESXi Analytic 0952

Detects unauthorized modification of host binaries, modules, or services within ESXi. Correlates tampered files with subsequent unexpected service behavior or malicious module load attempts.

  • esxi:hostd binary or module replacement event
  • esxi:vmkernel unexpected module load

View on attack.mitre.org ↗

elastic/detection-rules

9 rules
Detection Severity Format
Potential Masquerading as System32 DLL High Elastic TOML
Potential Masquerading as Communication Apps Medium Elastic TOML
Potential SSH Password Grabbing via strace Medium Elastic TOML
Suspicious Communication App Child Process Medium Elastic TOML
Unusual Process Modifying GenAI Configuration File Medium Elastic TOML
Potential OpenSSH Backdoor Logging Activity Low Elastic TOML
Renaming of OpenSSH Binaries Low Elastic TOML
Sublime Plugin or Application Script Modification Low Elastic TOML
Unusual Exim4 Child Process Low Elastic TOML

SigmaHQ/sigma

6 rules
Detection Severity Format
DNS HybridConnectionManager Service Bus High Sigma
HybridConnectionManager Service Installation High Sigma
HybridConnectionManager Service Running High Sigma
TanStack Supply-Chain Attack File Creation Indicators - Windows Medium Sigma
Linux Setgid Capability Set on a Binary via Setcap Utility Low Sigma
Linux Setuid Capability Set on a Binary via Setcap Utility Low Sigma

elastic/protections-artifacts

6 rules
Detection Severity Format
Application Javascript Injection via Nodejs Undefined Elastic TOML
Potential Remote Code Execution via Database Server Undefined Elastic TOML
Potential Remote Code Execution via Mail Server Undefined Elastic TOML
Potential Remote Code Execution via URL Encoded Payload Undefined Elastic TOML
Unusual SSH Parent/Child Execution Undefined Elastic TOML
VScode Project File Infection via Osascript Undefined Elastic TOML

splunk/security_content

4 rules
Detection Severity Format
Circle CI Disable Security Job Undefined SPL
Circle CI Disable Security Step Undefined SPL
GitHub Workflow File Creation or Modification Undefined SPL
Shai-Hulud Workflow File Creation or Modification Undefined SPL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Potential Build Process Compromise Medium KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.