Techniques › T1195.001 › AN0023
AN0023 Analytic 0023
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Developer tools (Homebrew, pip, npm/yarn, Xcode builds) install or update dependencies; new Mach-O or scripts appear under /usr/local, /opt/homebrew, ~/Library/Application Support, project dirs (node_modules/.bin, venv/bin). First run spawns sh/zsh/osascript/curl and new outbound flows; Gatekeeper/AMFI may flag unsigned components.</p>
- Detects
- T1195.001 Compromise Software Dependencies and Development Tools
- Part of
- DET0009 Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | softwareupdated/homebrew/install logs, pkginstalld events | DC0059 File Metadata |
| macos:endpointsecurity | exec | DC0032 Process Creation |
| NSM:Flow | First-time egress to non-approved registries after dependency install | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedTeamIDs | Apple Developer Team IDs for approved dev tools (Xcode, JetBrains, etc.). |
BrewTapsAllowList | Homebrew taps allowed in your environment. |
TimeWindow | Default 90 minutes. |