TeamPCPG1056 ↗
Has modified software packages with preinstall scripts to download and execute malicious payloads.1
tfMITRE ATT&CK sub-technique
Installer Packages T1546.016
sub-technique of T1546 Event Triggered Execution
- Tactics
- Persistence, Privilege Escalation
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 27 September 2022
- Last modified
- 12 May 2026
- Contributors
- Brandon Dalton @PartyD0lphin; Rodchenko Aleksandr
Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Installer Packages MITRE reference T1546.016
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus added a malicious .dylib file to a .dmg installer package for the macOS 3CX application.1
All 1 campaigns for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Can inject malicious pre or post-install scripts within package.json for payload execution.1
Shai-HuludS9008 ↗
Has inserted a new lifecycle hook to include postinstall.1234 Shai-Hulud has also leveraged the NPM lifecycle hook preinstall.5264
AppleJeusS0584 ↗
During AppleJeus's installation process, it uses postinstall scripts to extract a hidden plist from the application's /Resources folder and execute the plist file as a Launch Daemon with elevated permissions.1
All 3 software entries for this technique
Offense vs defense T1546.016
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Installer Packages detection strategy DET0330
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1546.016 - Event Triggered Execution via Installer Packages
3 platforms
AN0938 · macOS
Correlation of package install event with execution of postinstall scripts containing unknown binaries or abnormal CLI usage. Look for /usr/sbin/installer execution followed by child processes originating from postinstall script.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents |
| File CreationDC0039 | macos:unifiedlog | Creation or modification of postinstall scripts within .pkg or .mpkg contents |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptLocation | Path to postinstall script varies depending on .pkg packaging and user temp directories. |
| ParentProcessName | Installers may vary (e.g., /usr/sbin/installer, Jamf, Munki). |
AN0939 · Linux
Detection of maintainer scripts (e.g., postinst, preinst) being modified or executed during dpkg or rpm operations. Watch for script content that spawns additional processes or writes outside package scope.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc. |
| File CreationDC0039 | auditd:SYSCALL | write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptName | May be postinst, preinst, prerm, or postrm depending on packaging system |
| PackageManager | Depends on system: dpkg, apt, rpm, yum, etc. |
AN0940 · Windows
Detection of msiexec.exe running installer packages that result in anomalous process creation. Look for unexpected binaries executed by msiexec or custom action DLLs in the temp directory.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InstallerParent | Could be msiexec.exe or third-party wrapper like setup.exe. |
| ChildImagePath | Payload paths vary based on where installer extracts to (e.g., %TEMP%, C:\Users\Public). |
| ExecutionTimeWindow | Threshold for how soon a payload must run after msiexec to be considered related. |