{"id":"T1546.016","name":"Installer Packages","url":"https://attack.mitre.org/techniques/T1546/016","tactics":["privilege-escalation","persistence"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0330","stix_id":"x-mitre-detection-strategy--04f3b20d-e208-4ca3-b1e5-9e996013bc8a","name":"Detection Strategy for T1546.016 - Event Triggered Execution via Installer Packages","url":"https://attack.mitre.org/detectionstrategies/DET0330","analytics":[{"id":"AN0938","stix_id":"x-mitre-analytic--3ae8f3c1-c3a1-4c45-9231-1bb6f9c61ee1","name":"Analytic 0938","description":"Correlation of package install event with execution of postinstall scripts containing unknown binaries or abnormal CLI usage. Look for `/usr/sbin/installer` execution followed by child processes originating from postinstall script.","url":"https://attack.mitre.org/detectionstrategies/DET0330#AN0938","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Creation or modification of postinstall scripts within .pkg or .mpkg contents","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ScriptLocation","description":"Path to postinstall script varies depending on .pkg packaging and user temp directories."},{"field":"ParentProcessName","description":"Installers may vary (e.g., /usr/sbin/installer, Jamf, Munki)."}],"live":true,"detection_strategies":["DET0330"],"techniques":["T1546.016"]},{"id":"AN0939","stix_id":"x-mitre-analytic--2f9c7e44-de3a-4fbd-955a-482ef9f341ed","name":"Analytic 0939","description":"Detection of maintainer scripts (e.g., postinst, preinst) being modified or executed during dpkg or rpm operations. Watch for script content that spawns additional processes or writes outside package scope.","url":"https://attack.mitre.org/detectionstrategies/DET0330#AN0939","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc.","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ScriptName","description":"May be postinst, preinst, prerm, or postrm depending on packaging system"},{"field":"PackageManager","description":"Depends on system: dpkg, apt, rpm, yum, etc."}],"live":true,"detection_strategies":["DET0330"],"techniques":["T1546.016"]},{"id":"AN0940","stix_id":"x-mitre-analytic--9c9db399-4f87-477b-be31-536857b7912d","name":"Analytic 0940","description":"Detection of msiexec.exe running installer packages that result in anomalous process creation. Look for unexpected binaries executed by msiexec or custom action DLLs in the temp directory.","url":"https://attack.mitre.org/detectionstrategies/DET0330#AN0940","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"InstallerParent","description":"Could be msiexec.exe or third-party wrapper like setup.exe."},{"field":"ChildImagePath","description":"Payload paths vary based on where installer extracts to (e.g., %TEMP%, C:\\Users\\Public)."},{"field":"ExecutionTimeWindow","description":"Threshold for how soon a payload must run after msiexec to be considered related."}],"live":true,"detection_strategies":["DET0330"],"techniques":["T1546.016"]}],"live":true,"version":"1.0","techniques":["T1546.016"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}