tfMITRE ATT&CK sub-technique

Malicious Library T1204.005

Tactic: Execution
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 22 May 2025
Last modified: 22 May 2025

Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Malicious Library MITRE reference T1204.005

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.1 2 3 4 5 6 7 8 9 10

created 2025-10-1910 referencesaka DeceptiveDevelopment

All 1 groups for this technique

Offense vs defense T1204.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Malicious Library detection strategy DET0252

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

User-Initiated Malicious Library Installation via Package Manager (T1204.005)

Enterprise

3 platforms

AN0698 · Linux

User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications. Defender sees pip install or npm install commands run by a non-root user, followed shortly by new .py, .sh, or .js files in hidden directories, or interpreter-based execution during boot/login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Execution of pip, npm, gem, or similar package managers
File CreationDC0039	auditd:PATH	New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install
Network Traffic ContentDC0085	NSM:Flow	http::request: Network connection to package registry or C2 from interpreter shortly after install

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PackageManagerList	Monitored package managers (e.g., pip, npm, gem, poetry, conda)
InstallWritePaths	Directories to watch for post-install execution artifacts (e.g., ~/.local/, /usr/lib/python3.8/site-packages/)
UserContextScope	Filter to focus on non-system accounts (e.g., interactive shell users)
TimeWindow	Correlate install command to subsequent network/file activity (default: 5 min)

AN0699 · Windows

Execution of pip.exe, npm.cmd, or MSI installers within user context, followed by script interpreter startup (e.g., python.exe) or PowerShell with unusual child processes or file writes in %APPDATA%, %TEMP%, or %LOCALAPPDATA%. Defender correlates command-line install tools with Sysmon and Event Logs to trace downstream behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedParentProcesses	Filter expected automation tools (e.g., enterprise installers, known IDEs)
InstallPathsToWatch	Suspicious post-install write paths (e.g., %APPDATA%, %TEMP%)
ExecutableEntropyThreshold	Used for evaluating if dropped files are packed/obfuscated

AN0700 · macOS

Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains. Defender links Terminal commands to plist creation, unsigned binary launches, and python3 or node processes connecting to remote endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Command line invocation of pip3, brew install, npm install from interactive Terminal
File MetadataDC0059	macos:unifiedlog	Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/
Network Connection CreationDC0082	NSM:Flow	Outbound HTTP/S initiated by newly installed interpreter process

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StartupAgentPaths	Filter user persistence plist directories like ~/Library/LaunchAgents
UnsignedBinaryAlerting	Enable alerting for new binaries lacking Apple or organization signature
InstallToNetWindow	Correlate install action to interpreter-based network behavior

Malicious Library detections T1204.005

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs