T1204.005 Malicious Library

execution — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1204.005

KEV CVEs mapped here

<p>Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.</p><p>In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0252 User-Initiated Malicious Library Installation via Package Manager (T1204.005) v1.0
AN0698 Linux
User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications. Defender sees pip install or npm install commands run by a non-root user, followed shortly by new .py, .sh, or .js files in hidden directories, or interpreter-based execution during boot/login.

auditd:SYSCALL execve: Execution of pip, npm, gem, or similar package managers → DC0032 Process Creation
auditd:PATH New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install → DC0039 File Creation
NSM:Flow http::request: Network connection to package registry or C2 from interpreter shortly after install → DC0085 Network Traffic Content

Tunable: PackageManagerList InstallWritePaths UserContextScope TimeWindow

AN0699 Windows
Execution of pip.exe, npm.cmd, or MSI installers within user context, followed by script interpreter startup (e.g., python.exe) or PowerShell with unusual child processes or file writes in %APPDATA%, %TEMP%, or %LOCALAPPDATA%. Defender correlates command-line install tools with Sysmon and Event Logs to trace downstream behavior.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: AllowedParentProcesses InstallPathsToWatch ExecutableEntropyThreshold

AN0700 macOS
Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains. Defender links Terminal commands to plist creation, unsigned binary launches, and python3 or node processes connecting to remote endpoints.

macos:unifiedlog Command line invocation of pip3, brew install, npm install from interactive Terminal → DC0032 Process Creation
macos:unifiedlog Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/ → DC0059 File Metadata
NSM:Flow Outbound HTTP/S initiated by newly installed interpreter process → DC0082 Network Connection Creation

Tunable: StartupAgentPaths UnsignedBinaryAlerting InstallToNetWindow

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1204.005`

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1204) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Potentially Suspicious WebDAV LNK Execution mediumtest

Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe

Detects possible execution via LNK file accessed on a WebDAV server.

Techniques: T1059.001 T1204

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest

Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e

The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Techniques: T1204 T1566.001

Potential Snatch Ransomware Activity highstable

Author: Florian Roth (Nextron Systems) · 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff

Detects specific process characteristics of Snatch ransomware word document droppers

Techniques: T1204

Suspicious Deno File Written from Remote Source lowexperimental

Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Techniques: T1204 T1059.007 T1105

Suspicious Execution via macOS Script Editor mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4

Detects when the macOS Script Editor utility spawns an unusual child process.

Techniques: T1566 T1566.002 T1059 T1059.002 T1204 T1204.001 T1553

DarkSide Ransomware Pattern criticaltest

Author: Florian Roth (Nextron Systems) · 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c

Detects DarkSide Ransomware and helpers

Techniques: T1204

Suspicious Binaries and Scripts in Public Folder highexperimental

Author: The DFIR Report · 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e

Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Techniques: T1204

PrinterNightmare Mimikatz Driver Name criticaltest

Author: Markus Neis, @markus_neis, Florian Roth · 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Techniques: T1204

CVE tags: CVE-2021-1675CVE-2021-34527

Antivirus - Hacktool Signature highstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba

Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1204

T1204.005 Malicious Library

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1204.005

Rules tagged at the parent level (attack.t1204) 10

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1204.005`