Event Triggered Execution: Installer Packages `T1546.016`

Tactics: Privilege Escalation, Persistence

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution

Authoring guide

These 15 rules share fields, values, and exclusions.

Fields filtered most (23 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	14	`eq` 8, `in` 4, `ne` 2	`exec`, `connection_attempted`, `creation`, `rename`, `deletion`
`event.type`	12	`eq` 12	`start`
`host.os.type`	9	`eq` 9
`process_name`	8	`in` 5, `eq` 2, `wildcard` 2	`bash`, `cp`, `csh`, `mv`, `awk`
`TargetFilename`	5	`starts_with` 3, `wildcard` 2	`/etc/apt/apt.conf.d/`, `/etc/dnf/plugins/`, `/etc/yum/pluginconf.d/`, `/library/containers/`, `/library/fonts/`
`parent_process_name`	5	`eq` 2, `in` 2, `wildcard` 1	`bash`, `apt`, `csh`, `dash`, `sh`
`process.args`	5	`eq` 2, `in` 2, `starts_with` 1, `wildcard` 1	`--install`, `-c`, `-i`, `/Users/`, `/Volumes/`
`Image`	2	`starts_with` 1, `wildcard` 1	`./`, `/boot/`, `/dev/shm/*`, `/var/lib/dpkg/info/`
`event.category`	2	`eq` 2	`process`
`file.Ext.header_bytes`	2	`starts_with` 2	`cafebabe`, `cffaedfe`
`process.code_signature.exists`	2	`eq` 2	`false`
`process.code_signature.trusted`	2	`eq` 2	`false`
`ParentImage`	1	`starts_with` 1	`/var/lib/dpkg/info/`
`Persistence.args`	1	`wildcard` 1	`/Applications/`, `/Library/Application Support/`, `/Users//Library/Application Support/`
`event0.Persistence.args`	1	`starts_with` 1	`process.executable`

Top indicator values (135 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticDPKG Package Installed by Unusual Parent Process elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticInitial Access Staging via Installer Package elasticRPM Package Installed by Unusual Parent Process elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection elasticSuspicious File Creation via Pkg Install Script elasticUnsigned or Untrusted Process Execution via Installer elasticUntrusted or Unsigned Binary Executed via Launch Service elasticUnusual DPKG Execution	12	1087
`EventType`	`eq`	`exec` elasticDPKG Package Installed by Unusual Parent Process elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticRPM Package Installed by Unusual Parent Process elasticSuspicious APT Package Manager Network Connection elasticUntrusted or Unsigned Binary Executed via Launch Service elasticUnusual DPKG Execution	8	579
`EventType`	`eq`	`connection_attempted` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4	75
`EventType`	`in`	`creation` elasticAPT Package Manager Configuration File Creation elasticDNF Package Manager Plugin File Creation elasticYum Package Manager Plugin File Creation	3	34
`EventType`	`in`	`rename` elasticAPT Package Manager Configuration File Creation elasticDNF Package Manager Plugin File Creation elasticYum Package Manager Plugin File Creation	3	27
`process_name`	`in`	`bash` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection elasticSuspicious File Creation via Pkg Install Script	3	202
`process_name`	`in`	`cp` elasticInitial Access Staging via Installer Package elasticSuspicious File Creation via Pkg Install Script elasticUntrusted or Unsigned Binary Executed via Launch Service	3	18
`process_name`	`in`	`mv` elasticInitial Access Staging via Installer Package elasticSuspicious File Creation via Pkg Install Script elasticUntrusted or Unsigned Binary Executed via Launch Service	3	16
`process_name`	`in`	`sh` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection elasticSuspicious File Creation via Pkg Install Script	3	197
`process_name`	`in`	`zsh` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection elasticSuspicious File Creation via Pkg Install Script	3	196
`process_name`	`in`	`csh` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	159
`process_name`	`in`	`dash` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	170
`process_name`	`in`	`fish` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	163
`process_name`	`in`	`ksh` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	163
`process_name`	`in`	`tcsh` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	156
`EventType`	`ne`	`deletion` elasticInitial Access Staging via Installer Package elasticSuspicious File Creation via Pkg Install Script	2	87
`event.category`	`eq`	`process` elasticDPKG Package Installed by Unusual Parent Process elasticRPM Package Installed by Unusual Parent Process	2	141
`file.Ext.header_bytes`	`starts_with`	`cafebabe` elasticInitial Access Staging via Installer Package elasticSuspicious File Creation via Pkg Install Script	2	19
`file.Ext.header_bytes`	`starts_with`	`cffaedfe` elasticInitial Access Staging via Installer Package elasticSuspicious File Creation via Pkg Install Script	2	19
`parent_process_name`	`eq`	`apt` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	2
`parent_process_name`	`in`	`bash` elasticEgress Network Connection from RPM Package elasticUnsigned or Untrusted Process Execution via Installer	2	66
`parent_process_name`	`in`	`sh` elasticEgress Network Connection from RPM Package elasticUnsigned or Untrusted Process Execution via Installer	2	66
`parent_process_name`	`in`	`zsh` elasticEgress Network Connection from RPM Package elasticUnsigned or Untrusted Process Execution via Installer	2	64
`process.args`	`eq`	`-c` elasticSuspicious APT Package Manager Execution elasticSuspicious APT Package Manager Network Connection	2	107
`process.args`	`in`	`--install` elasticDPKG Package Installed by Unusual Parent Process elasticRPM Package Installed by Unusual Parent Process	2	3
`process.args`	`in`	`-i` elasticDPKG Package Installed by Unusual Parent Process elasticRPM Package Installed by Unusual Parent Process	2	10
`process.code_signature.exists`	`eq`	`false` elasticUnsigned or Untrusted Process Execution via Installer elasticUntrusted or Unsigned Binary Executed via Launch Service	2	119
`process.code_signature.trusted`	`eq`	`false` elasticUnsigned or Untrusted Process Execution via Installer elasticUntrusted or Unsigned Binary Executed via Launch Service	2	115
`process_name`	`wildcard`	`awk` elasticEgress Connection by a DNF Package Manager Descendant elasticSuspicious APT Package Manager Execution	2	7
`process_name`	`wildcard`	`bash` elasticEgress Connection by a DNF Package Manager Descendant elasticSuspicious APT Package Manager Execution	2	39

Exclusions (235 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`dest_ip`	`cidr_match`	`10.0.0.0/8` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`100.64.0.0/10` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`127.0.0.0/8` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`169.254.0.0/16` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`172.16.0.0/12` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`172.31.0.0/16` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.0/24` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.0/29` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.10/32` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.170/32` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.171/32` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.8/32` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.0.9/32` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.0.2.0/24` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4
`dest_ip`	`cidr_match`	`192.168.0.0/16` elasticEgress Connection by a DNF Package Manager Descendant elasticEgress Network Connection from Default DPKG Directory elasticEgress Network Connection from RPM Package elasticSuspicious APT Package Manager Network Connection	4

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Event Triggered Execution: Installer Packages T1546.016