Compromise Host Software Binary T1554

Tactic: Persistence

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.

Events covered

21 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 39 rules share fields, values, and exclusions.

Fields filtered most (52 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
event.type14eq 14start, creation, change, end
host.os.type13eq 13
EventType12eq 11, in 1exec, modification, load, overwrite
process_name11eq 8, in 4, starts_with 2, wildcard 2, is_not_null 1., base16, base32, sshd, .*
TargetFilename9wildcard 4, in 3, ends_with 2, contains 1, match 1, starts_with 1*/.github/workflows/*.yaml, */.github/workflows/*.yml, */.github/workflows/discussion.yaml, */.github/workflows/discussion.yml, */.github/workflows/formatter_*.yaml
Image8starts_with 3, wildcard 3, ends_with 2, eq 2, contains 1, ne 1./, /bin/cat, /bin/chmod, /setcap, ./*
parent_process_name6eq 5, in 3amavisd, amavisd-new, beam.smp, ciscocollabhost.exe, clickhouse-server
CommandLine5contains 4, regex_match 3, wildcard 3 /dev/shm/, /home/, /run/, */.ssh/*, */bin/sh%*
file.extension4eq 40, 1, 2, js, pbxproj
DAVISRiskLevel3eq 2, ne 1CRITICAL
Muted3eq 3false
process.args_count3le 2, eq 12, 1
BuildProcessTime2cross_field_compare 2FileEditTime
Effective_process.name2eq 2node, osascript
Hashes2is_not_null 2

Top indicator values (3825 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
111078
EventTypeeq
exec
6576
EventTypeeq
modification
372
CommandLinewildcard
*/etc/passwd*
310
Imagestarts_with
./
326
Imagestarts_with
/dev/shm/
353
Imagestarts_with
/root/
313
Imagestarts_with
/tmp/
358
Imagestarts_with
/var/tmp/
356
Mutedeq
false
33
process_namein
bash
3202
process_namein
csh
3159
process_namein
dash
3170
process_namein
fish
3163
process_namein
ksh
3163
process_namein
sh
3197
process_namein
tcsh
3156
process_namein
zsh
3196
BuildProcessTimecross_field_compare
FileEditTime
22
CommandLinecontains
/dev/shm/
22
CommandLinecontains
/home/
22
CommandLinecontains
/run/
22
CommandLinecontains
/tmp/
24
CommandLinecontains
/var/run/
22
CommandLinecontains
/var/tmp/
22
CommandLinecontains
/var/www/
22
CommandLinecontains
~/
22
CommandLinecontains
curl
217
CommandLinecontains
exec
210
CommandLinecontains
file
24

Exclusions (365 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
process.code_signature.trustedeq
true
3
Imagewildcard
/tmp/newroot/*
2
Imagewildcard
?:\users\*\appdata\local\google\chrome\application\chrome.exe
2
Imagewildcard
?:\users\*\appdata\local\island\island\application\island.exe
2
Imagewildcard
?:\users\*\appdata\local\mozilla firefox\firefox.exe
2
Imagewildcard
?:\windows\system32\werfault.exe
2
Imagewildcard
?:\windows\syswow64\werfault.exe
2
dll.code_signature.trustedeq
true
2
CommandLinecontains
/usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli/wpt-wp-cli.php
1
CommandLinecontains
/workdir/builder_client/layers/poky/scripts
1
CommandLinecontains
petalinux.xilinx.com
1
CommandLinecontains
pgsql
1
CommandLineeq
/bin/echo -n postfix is running
1
CommandLineeq
/usr/bin/gzip -d
1
CommandLineeq
epmd -daemon
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 6 rules

Elastic 20 rules

Splunk 4 rules

Kusto 9 rules