Techniques › T1195 › AN1482
AN1482 Analytic 1482
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.</p>
- Detects
- T1195 Supply Chain Compromise
- Part of
- DET0537 Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer | DC0059 File Metadata |
| macos:osquery | launchd, processes | DC0032 Process Creation |
| macos:endpointsecurity | write, rename | DC0061 File Modification |
| NSM:Flow | New egress from app just installed to unknown update endpoints | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedTeamIDs | Apple Developer Team IDs permitted in your fleet. |
TrustedDMGs | Known DMG/Pkg sources and hashes. |
TimeWindow | Install→first-run correlation window (default 2h). |
RiskScoreThreshold | Adjust alert sensitivity based on org tolerance. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2024-49035 | Microsoft Partner Center | Mapped |