{"id":"T1554","name":"Compromise Host Software Binary","url":"https://attack.mitre.org/techniques/T1554","tactics":["persistence"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0336","stix_id":"x-mitre-detection-strategy--110a934e-881a-4e42-9619-b6de30f4a39e","name":"Detect Compromise of Host Software Binaries","url":"https://attack.mitre.org/detectionstrategies/DET0336","analytics":[{"id":"AN0949","stix_id":"x-mitre-analytic--e2ebd04e-074d-4b90-b94c-a43048b1c3ac","name":"Analytic 0949","description":"Monitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.","url":"https://attack.mitre.org/detectionstrategies/DET0336#AN0949","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"MonitoredPaths","description":"Define critical directories (e.g., C:\\Windows\\System32, Program Files) for binary integrity checks"},{"field":"SignatureValidation","description":"Adjust enforcement level of digital signature verification based on enterprise risk appetite"},{"field":"TimeWindow","description":"Correlate file modification with subsequent process execution within a defined time window"}],"live":true,"detection_strategies":["DET0336"],"techniques":["T1554"]},{"id":"AN0950","stix_id":"x-mitre-analytic--9b2ff34a-1967-46a9-b355-f9584a0715b5","name":"Analytic 0950","description":"Detects modification of system or application binaries by monitoring /usr/bin, /bin, and other privileged directories. Correlates file integrity monitoring (FIM) events with unexpected process executions or service restarts.","url":"https://attack.mitre.org/detectionstrategies/DET0336#AN0950","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"WatchedDirectories","description":"Customize monitored directories (e.g., /usr/bin, /usr/sbin, /opt/apps) for binary tampering"},{"field":"BaselineHashes","description":"Maintain golden file hashes for integrity validation"}],"live":true,"detection_strategies":["DET0336"],"techniques":["T1554"]},{"id":"AN0951","stix_id":"x-mitre-analytic--88eaf8ce-b48d-4329-a147-dd5d065cead2","name":"Analytic 0951","description":"Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0336#AN0951","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"binary modified or replaced","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"execution of modified binary without valid signature","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ApplicationPaths","description":"Tune which application and library directories are monitored for tampering"},{"field":"SignatureVerificationDepth","description":"Define strictness of code-signing validation checks"}],"live":true,"detection_strategies":["DET0336"],"techniques":["T1554"]},{"id":"AN0952","stix_id":"x-mitre-analytic--fa36a169-1cca-4887-b362-e3cceb02414f","name":"Analytic 0952","description":"Detects unauthorized modification of host binaries, modules, or services within ESXi. Correlates tampered files with subsequent unexpected service behavior or malicious module load attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0336#AN0952","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"binary or module replacement event","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"esxi-hostd"},{"name":"esxi:vmkernel","channel":"unexpected module load","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"MonitoredModules","description":"Define critical ESXi binaries and kernel modules requiring integrity validation"},{"field":"CorrelationWindow","description":"Adjust timing correlation between binary modification and module/service anomalies"}],"live":true,"detection_strategies":["DET0336"],"techniques":["T1554"]}],"live":true,"version":"1.0","techniques":["T1554"]}],"sigma_rules":[{"id":"0ee4d8a5-4e67-4faf-acfa-62a78457d1f2","title":"HybridConnectionManager Service Installation","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2021-04-12","modified":"2022-10-09","description":"Rule to detect the Hybrid Connection Manager service installation.","references":["https://twitter.com/Cyb3rWard0g/status/1381642789369286662"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.t1554"],"path":"rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml","techniques":["T1554"],"cves":[]},{"id":"3a716279-c18c-4488-83be-f9ececbfb9fc","title":"Linux Setgid Capability Set on a Binary via Setcap Utility","author":"Luc Génaux","status":"experimental","level":"low","date":"2026-01-24","modified":null,"description":"Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.\nThis capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).\nThis behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\n","references":["https://man7.org/linux/man-pages/man8/setcap.8.html","https://dfir.ch/posts/linux_capabilities/","https://juggernaut-sec.com/capabilities/#cap_setgid"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1548","attack.t1554"],"path":"rules/linux/process_creation/proc_creation_lnx_cap_setgid.yml","techniques":["T1548","T1554"],"cves":[]},{"id":"7bd3902d-8b8b-4dd4-838a-c6862d40150d","title":"DNS HybridConnectionManager Service Bus","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2021-04-12","modified":"2023-01-16","description":"Detects Azure Hybrid Connection Manager services querying the Azure service bus service","references":["https://twitter.com/Cyb3rWard0g/status/1381642789369286662"],"logsource":{"product":"windows","category":"dns_query"},"tags":["attack.persistence","attack.t1554"],"path":"rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml","techniques":["T1554"],"cves":[]},{"id":"8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a","title":"TanStack Supply-Chain Attack File Creation Indicators - Windows","author":"Leonardo Gasparini","status":"experimental","level":"medium","date":"2026-05-12","modified":null,"description":"Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.t1059.007","attack.persistence","attack.t1554","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml","techniques":["T1195.002","T1059.007","T1554"],"cves":[]},{"id":"b55d23e5-6821-44ff-8a6e-67218891e49f","title":"HybridConnectionManager Service Running","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2021-04-12","modified":"2024-08-05","description":"Rule to detect the Hybrid Connection Manager service running on an endpoint.","references":["https://twitter.com/Cyb3rWard0g/status/1381642789369286662"],"logsource":{"product":"windows","service":"microsoft-servicebus-client"},"tags":["attack.persistence","attack.t1554"],"path":"rules/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml","techniques":["T1554"],"cves":[]},{"id":"ed447910-bc30-4575-a598-3a2e49516a7a","title":"Linux Setuid Capability Set on a Binary via Setcap Utility","author":"Luc Génaux","status":"experimental","level":"low","date":"2026-01-24","modified":null,"description":"Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.\nThis capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).\nThis behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.\n","references":["https://man7.org/linux/man-pages/man8/setcap.8.html","https://dfir.ch/posts/linux_capabilities/","https://juggernaut-sec.com/capabilities/#cap_setuid"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1548","attack.t1554"],"path":"rules/linux/process_creation/proc_creation_lnx_cap_setuid.yml","techniques":["T1548","T1554"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}