AN1480 Analytic 1480

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.</p>

Detects: T1195 Supply Chain Compromise
Part of: DET0537 Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Sysmon	`EventCode=1`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=7`	DC0016 Module Load
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	`CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries`	DC0059 File Metadata
NSM:Flow	`First-time egress from host after new install to unknown update endpoints`	DC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Correlation window between install events and first-run activity (default 2h; adjust for staged rollouts).
`TrustedPublishers`	Publisher/Signer allow-list to suppress expected updates.
`TrustedUpdateHosts`	Known update CDNs/APIs (e.g., download.microsoft.com) to reduce egress false positives.
`RiskScoreThreshold`	Score cut-off for alerting when combining path, signer, and reputation features.

KEV CVEs whose mapped technique this analytic detects

CVE	Vendor / product	State
CVE-2024-49035	Microsoft Partner Center	Mapped