T1204.005 — Malicious Library

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing…

Sub-technique of User Execution (T1204).

Sigma detection rules (3)

T1204.005 User Execution: Malicious Library

title: "T1204.005 User Execution: Malicious Library"
id: 5a06b3c3-5dc7-4be7-9688-8755b1d5ebbb
description: 'Detects invocation of package manager clients (npm, pip, yarn, pnpm) with an install action, consistent with a user installing a malicious library from a public package repository (User Execution: Malicious Library). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AllowedParentProcesses, InstallPathsToWatch, ExecutableEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1204/005
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.execution
  - attack.t1204.005

logsource:
  category: process_creation
  product: windows

detection:
  selection_pkgmgr:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\pip.exe'
      - '\pip3.exe'
      - '\yarn.cmd'
      - '\pnpm.cmd'
  selection_install:
    CommandLine|contains: 'install'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_pkgmgr and selection_install and not filter_system_account

falsepositives:
  - Routine developer dependency installs from trusted internal registries — tune AllowedParentProcesses/InstallPathsToWatch to reduce noise.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account.

level: medium

T1204.005 User Execution: Malicious Library

title: "T1204.005 User Execution: Malicious Library"
id: c7493d12-0bf4-40a1-9d8b-400b78cd736a
description: 'User-Initiated Malicious Library Installation via Package Manager (T1204.005), retargeted to the npm/PyPI/Yarn ecosystem the technique description centers on rather than OS package managers (dpkg/apt/rpm/yum), and fixed a logic bug where the prior version required exe (the invoked binarys own path) to be under /tmp or /dev/shm on the same EXECVE event as a0 being dpkg/apt/rpm/yum - since a0 and exe both describe the same binary, and a real system package manager always lives under /usr/bin or /bin, the two conditions could never both be true. Tune using: PackageManagerList, InstallWritePaths, UserContextScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1204/005
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.execution
  - attack.t1204.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/npm'
      - '/npx'
      - '/pip'
      - '/pip3'
      - '/yarn'
      - '/pnpm'
  selection_install:
    a1:
      - 'install'
      - 'i'
      - 'add'

  condition: selection_tool and selection_install

falsepositives:
  - Routine developer/CI/CD dependency installs; auditd command-line telemetry alone cannot evaluate package-name reputation or typosquatting, so true malicious-library confirmation requires the PackageManagerList/InstallWritePaths tuning to be enforced against a reputation feed downstream of this rule.

level: medium

T1204.005 User Execution: Malicious Library

title: "T1204.005 User Execution: Malicious Library"
id: caf5152a-832c-49f4-9aaf-c4657990f3a5
description: 'User-Initiated Malicious Library Installation via Package Manager (T1204.005). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StartupAgentPaths, UnsignedBinaryAlerting, InstallToNetWindow.'
references:
  - https://attack.mitre.org/techniques/T1204/005
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.execution
  - attack.t1204.005

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/installer'
    ParentImage|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
  selection_path:
    CommandLine|contains:
      - '/private/tmp/'
      - '/Library/LaunchAgents/'
  condition: selection and selection_path

falsepositives:
  - Legitimate scripted software installations that stage a pkg installer in a temp directory before invoking it as part of a normal deployment pipeline.

level: high

Related sub-techniques

Explore