Techniques › T1204.005 › AN0700
AN0700 Analytic 0700
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains. Defender links Terminal commands to plist creation, unsigned binary launches, and
python3 or node processes connecting to remote endpoints.</p>- Detects
- T1204.005 Malicious Library
- Part of
- DET0252 User-Initiated Malicious Library Installation via Package Manager (T1204.005)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Command line invocation of pip3, brew install, npm install from interactive Terminal | DC0032 Process Creation |
| macos:unifiedlog | Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/ | DC0059 File Metadata |
| NSM:Flow | Outbound HTTP/S initiated by newly installed interpreter process | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
StartupAgentPaths | Filter user persistence plist directories like ~/Library/LaunchAgents |
UnsignedBinaryAlerting | Enable alerting for new binaries lacking Apple or organization signature |
InstallToNetWindow | Correlate install action to interpreter-based network behavior |