Techniques › T1195.002 › AN0863
AN0863 Analytic 0863
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A compromised package/update (deb/rpm/tarball/AppImage/vendor updater) is installed, writing/overwriting files in /usr/local/bin, /usr/bin, /opt, or ~/.local; first run executes unexpected shells/curl/wget and connects to unapproved hosts. Correlate package/updater execution → file writes/replace → first-run child processes → egress.</p>
- Detects
- T1195.002 Compromise Software Supply Chain
- Part of
- DET0309 Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| journald:package | dpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals | DC0059 File Metadata |
| NSM:Flow | New outbound flows to non-approved vendor hosts post install | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PathScope | Monitored install paths (/usr/local, /usr/bin, /opt/*, ~/.local/bin, /var/lib/systemd). |
ApprovedRepos | Allow-listed APT/YUM repos and GPG keys for vendor updates. |
TimeWindow | Default 90 minutes. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | Mapped |
| CVE-2024-4978 | Justice AV Solutions Viewer | Mapped |