Techniques › T1195 › AN1481
AN1481 Analytic 1481
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.</p>
- Detects
- T1195 Supply Chain Compromise
- Part of
- DET0537 Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve, unlink | DC0032 Process Creation |
| auditd:SYSCALL | open, rename | DC0020 Process Modification |
| journald:package | dpkg/apt install, remove, upgrade events | DC0059 File Metadata |
| NSM:Flow | First-time egress to unknown registries/mirrors immediately after install | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ApprovedRepos | Allow-listed APT/YUM repo URLs and GPG key fingerprints. |
PathScope | Directories to watch for new ELF writes (e.g., /usr/bin, /usr/local/bin, /lib*/, /opt/*/bin). |
MinBinarySize | Ignore tiny helper files; default >16KB. |
TimeWindow | Install→first-run correlation window (default 2h). |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2024-49035 | Microsoft Partner Center | Mapped |