T1554 — Compromise Host Software Binary

Tactic: Persistence · Platforms: ESXi, Linux, macOS, Windows

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other…

Sigma detection rules (4)

T1554 Compromise Host Software Binary

title: T1554 Compromise Host Software Binary
id: d08c2517-37e4-4a3f-9af0-1706ae4ec735
description: 'Detects creation/overwrite of executable binaries under Program Files by a process other than a known installer, a proxy for adversaries replacing or backdooring a legitimate application binary (e.g. an SSH/FTP client) to establish persistence. Tune using: MonitoredPaths, SignatureValidation, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1554
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.persistence
  - attack.t1554

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
    TargetFilename|endswith: '.exe'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\TrustedInstaller.exe'
      - '\wusa.exe'
      - '\setup.exe'
      - '\TiWorker.exe'

  condition: selection and not filter_installers

falsepositives:
  - Legitimate application updates/installs performed by an updater process not in the installer allowlist; add the vendor's updater to filter_installers.

level: medium

T1554 Compromise Host Software Binary

title: T1554 Compromise Host Software Binary
id: 30b11565-01fe-455d-a1b6-a945e26ebfc0
description: 'Detect Compromise of Host Software Binaries. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedDirectories, BaselineHashes.'
references:
  - https://attack.mitre.org/techniques/T1554
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.persistence
  - attack.t1554

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/usr/bin/ssh'
      - '/usr/sbin/sshd'
      - '/usr/bin/sudo'
      - '/usr/bin/su'

  condition: selection

falsepositives:
  - Legitimate package-manager updates of these exact binaries; correlate the modifying process being a package manager (dpkg/rpm) to suppress, and compare against BaselineHashes to confirm an unexpected/unsigned modification.

level: critical

T1554 Compromise Host Software Binary

title: T1554 Compromise Host Software Binary
id: eb70b5d3-40a3-455e-9967-4ec44c619f9f
description: 'Detect Compromise of Host Software Binaries. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApplicationPaths, SignatureVerificationDepth.'
references:
  - https://attack.mitre.org/techniques/T1554
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.persistence
  - attack.t1554

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/codesign'
  selection_args:
    CommandLine|contains: '--verify'
  selection_fail:
    CommandLine|contains:
      - '.app/Contents/MacOS/'

  condition: selection and selection_args and selection_fail

falsepositives:
  - Automated code signature verification is a normal part of software update and Gatekeeper checks, so this rule should focus on cases where the verification is followed shortly by execution of a binary whose signature does not match the applications original developer ID, information not fully captured by process_creation events alone.

level: high

T1554 Compromise Host Software Binary

title: T1554 Compromise Host Software Binary
id: ca8cee66-12aa-4377-8cc8-d4245860de06
description: 'Detect Compromise of Host Software Binaries. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredModules, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1554
author: Shahrukh Khan
date: 2026-01-18
license: MIT
tags:
  - attack.persistence
  - attack.t1554

logsource:
  product: esxi
  service: vmkernel

detection:
  selection_signature:
    Message|contains:
      - 'unsigned'
      - 'signature verification failed'
      - 'not signed'
  selection_module:
    Message|contains: 'module'

  condition: selection_signature and selection_module

falsepositives:
  - Legitimate but unsigned or community-supported kernel modules loaded for hardware compatibility; ESXi does not expose a structured image_load event stream like an EDR would, so this is limited to boot-time and reload-time log lines and can miss a tampered binary that is not reloaded during the CorrelationWindow.

level: critical

Explore