T1546.016 — Installer Packages

Tactics: Privilege Escalation, Persistence · Platforms: Linux, macOS, Windows

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (3)

T1546.016 Event Triggered Execution: Installer Packages

title: "T1546.016 Event Triggered Execution: Installer Packages"
id: f8497e00-aad6-4c17-baf9-0aa44521a656
description: 'Detects msiexec.exe installing an MSI package staged in a user-writable or temporary location, a pattern used to smuggle installer scripts that inherit elevated permissions during installation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: InstallerParent, ChildImagePath, ExecutionTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1546/016
author: Shahrukh Khan
date: 2026-03-21
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.016

logsource:
  category: process_creation
  product: windows

detection:
  selection_msiexec:
    EventID: 1
    Image|endswith: '\msiexec.exe'

  selection_suspicious_path:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Windows\Temp\'
      - '\Downloads\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_msiexec and selection_suspicious_path and not filter_system_account

falsepositives:
  - Legitimate software deployment tools (SCCM, Intune) staging MSI packages in temp paths before installation; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1546.016 Event Triggered Execution: Installer Packages

title: "T1546.016 Event Triggered Execution: Installer Packages"
id: 8982a7ab-13ef-4319-94af-3e53437c1b34
description: 'Detection Strategy for T1546.016 - Event Triggered Execution via Installer Packages. (Retargeted: the previous rule watched creation of files under apt.conf.d/ and dnf plugins/, which is package-manager-hook persistence, not installer package scripting; this version instead watches EXECUTION of the actual dpkg/rpm maintainer scripts -- preinst/postinst/prerm/postrm under /var/lib/dpkg/info/, and rpm''s scriptlet temp files under /var/tmp/rpm-tmp.* -- which is what T1546.016 describes as running with inherited root privileges during package install/remove.) Tune using: ScriptName, PackageManager.'
references:
  - https://attack.mitre.org/techniques/T1546/016
author: Shahrukh Khan
date: 2026-04-26
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.016

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_dpkg_maintainer_script:
    type: EXECVE
    a0|contains: '/var/lib/dpkg/info/'
    a0|re: '.*\.(postinst|preinst|prerm|postrm)
    
  


  selection_rpm_scriptlet:
    type: EXECVE
    a0|contains: '/var/tmp/rpm-tmp.'

  condition: 1 of selection_*

falsepositives:
  - Legitimate package installs, upgrades, and removals via apt/dpkg or yum/dnf/rpm constantly execute maintainer scripts and scriptlets; scope ScriptName/PackageManager to unexpected packages outside normal deployment channels.

level: high

T1546.016 Event Triggered Execution: Installer Packages

title: "T1546.016 Event Triggered Execution: Installer Packages"
id: 6e93763f-cd45-4a42-bb0a-8b26a8352160
description: 'Detection Strategy for T1546.016 - Event Triggered Execution via Installer Packages. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptLocation, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1546/016
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.016

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/installer'
      - '/InstallerRemotePluginService'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/osascript'
  condition: selection and selection_child

falsepositives:
  - Software packages legitimately execute preinstall and postinstall shell scripts as part of the installer process, so this should be scoped to scripts that download additional payloads or establish persistence outside the packages own scope.

level: medium

Related sub-techniques

Explore