Techniques › T1554
T1554 Compromise Host Software Binary
persistence — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
6
Sigma rules tagged attack.t1554
0
KEV CVEs mapped here
<p>Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.</p><p>Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., Modify Authentication Process).</p><p>An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.</p><p>After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the
yum-versionlock command or versionlock.list file in Linux systems that use the yum package manager).</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0336 Detect Compromise of Host Software Binaries v1.0
AN0949 WindowsMonitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.Tunable:
MonitoredPathsSignatureValidationTimeWindowAN0950 LinuxDetects modification of system or application binaries by monitoring /usr/bin, /bin, and other privileged directories. Correlates file integrity monitoring (FIM) events with unexpected process executions or service restarts.Tunable:WatchedDirectoriesBaselineHashesAN0951 macOSMonitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.Tunable:ApplicationPathsSignatureVerificationDepthAN0952 ESXiDetects unauthorized modification of host binaries, modules, or services within ESXi. Correlates tampered files with subsequent unexpected service behavior or malicious module load attempts.Tunable:MonitoredModulesCorrelationWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1554
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2021-04-12 (modified 2022-10-09) · logsource: product=windows service=security · 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
Rule to detect the Hybrid Connection Manager service installation.
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · 3a716279-c18c-4488-83be-f9ececbfb9fc
Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2021-04-12 (modified 2023-01-16) · logsource: product=windows category=dns_query · 7bd3902d-8b8b-4dd4-838a-c6862d40150d
Detects Azure Hybrid Connection Manager services querying the Azure service bus service
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=file_event · 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2021-04-12 (modified 2024-08-05) · logsource: product=windows service=microsoft-servicebus-client · b55d23e5-6821-44ff-8a6e-67218891e49f
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · ed447910-bc30-4575-a598-3a2e49516a7a
Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.