Techniques › T1554 › AN0949
AN0949 Analytic 0949
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.</p>
- Detects
- T1554 Compromise Host Software Binary
- Part of
- DET0336 Detect Compromise of Host Software Binaries
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=2 | DC0061 File Modification |
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredPaths | Define critical directories (e.g., C:\Windows\System32, Program Files) for binary integrity checks |
SignatureValidation | Adjust enforcement level of digital signature verification based on enterprise risk appetite |
TimeWindow | Correlate file modification with subsequent process execution within a defined time window |