Techniques › T1195.002 › AN0864
AN0864 Analytic 0864
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A tampered app/pkg/notarized update is installed via installer, softwareupdated, Homebrew, or vendor updater; new Mach-O or bundle contents appear in /Applications, /Library, /usr/local or /opt/homebrew; first run spawns sh/zsh/osascript/curl and makes egress to unfamiliar domains; AMFI/Gatekeeper may log signature/notarization problems.</p>
- Detects
- T1195.002 Compromise Software Supply Chain
- Part of
- DET0309 Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | pkginstalld/softwareupdated/Homebrew install transactions | DC0059 File Metadata |
| macos:endpointsecurity | exec | DC0032 Process Creation |
| NSM:Flow | New/rare egress to non-approved update hosts after install | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedTeamIDs | Apple Developer Team IDs allowed for enterprise. |
BrewTapsAllowList | Trusted Homebrew taps. |
TimeWindow | Default 90 minutes. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | Mapped |
| CVE-2024-4978 | Justice AV Solutions Viewer | Mapped |