kevmap

TechniquesT1554 › AN0951

AN0951 Analytic 0951

macOS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.</p>
Detects
T1554 Compromise Host Software Binary
Part of
DET0336 Detect Compromise of Host Software Binaries

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
macos:unifiedlogbinary modified or replacedDC0061 File Modification
macos:unifiedlogexecution of modified binary without valid signatureDC0032 Process Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ApplicationPathsTune which application and library directories are monitored for tampering
SignatureVerificationDepthDefine strictness of code-signing validation checks