UNC3886G1048 ↗
Has trojanized Fortinet firmware and replaced the legitimate /usr/bin/tac_plus TACACS+ daemon for Linux with a malicious version containing credential logging functionality.12
tfMITRE ATT&CK technique
Compromise Host Software Binary T1554
- Tactic
- Persistence
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 2.2
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- CrowdStrike Falcon OverWatch; Liran Ravich, CardinalOps; Jamie Williams (U ω U), PANW Unit 42
Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.19
Tools & malwareTop 18%
Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.10
Detection rules74th pct
Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.Compromise Host Software Binary MITRE reference T1554
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT5G1023 ↗
Has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.12
All 2 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.1
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.123
2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.1
All 3 campaigns for this technique
19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has established persistence through modifying software binaries to include AI coding agents’ configuration or setting files that act as hooks, tasks or execution triggers.1
PHASEJAMS9014 ↗
Has modified legitimate components to enable persistence and execution, including inserting a web shell into getComponent.cgi and restAuth.cgi, modifying DSUpgrade.pm to block system upgrades, and overwriting remotedebug to execute arbitrary commands when specific parameters are provided.1
GlassWormS9010 ↗
Can modify hardware wallet applications.1
BOLDMOVES1184 ↗
Contains a watchdog-like feature that monitors a particular file for modification. If modification is detected, the legitimate file is backed up and replaced with a trojanized file to allow for persistence through likely system upgrades.1
BFG AgonizerS1136 ↗
Uses DLL unhooking to remove user mode inline hooks that security solutions often implement. BFG Agonizer also uses IAT unhooking to remove user-mode IAT hooks that security solutions also use.1
LITTLELAMB.WOOLTEAS1121 ↗
Can append malicious components to the tmp/tmpmnt/bin/samba_upgrade.tar archive inside the factory reset partition in attempt to persist post reset.1
All 19 software entries for this technique · 6 newest in this preview
Offense vs defense T1554
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 4
first rule: 2021 Q2 · 2 of 3 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016) falls before the 2018 window)Compromise Host Software Binary detection strategy DET0336
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Compromise of Host Software Binaries
4 platforms
AN0949 · Windows
Monitors for unexpected modifications of system or application binaries, particularly signed executables. Correlates file write events with subsequent unsigned or anomalously signed process execution, and checks for tampered binaries outside normal patch cycles.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredPaths | Define critical directories (e.g., C:\Windows\System32, Program Files) for binary integrity checks |
| SignatureValidation | Adjust enforcement level of digital signature verification based on enterprise risk appetite |
| TimeWindow | Correlate file modification with subsequent process execution within a defined time window |
AN0950 · Linux
Detects modification of system or application binaries by monitoring /usr/bin, /bin, and other privileged directories. Correlates file integrity monitoring (FIM) events with unexpected process executions or service restarts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | execve |
| File ModificationDC0061 | auditd:SYSCALL | open, write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedDirectories | Customize monitored directories (e.g., /usr/bin, /usr/sbin, /opt/apps) for binary tampering |
| BaselineHashes | Maintain golden file hashes for integrity validation |
AN0951 · macOS
Monitors binary modification in /Applications and system library paths. Detects unsigned or improperly signed binaries executed after modification. Tracks Gatekeeper or notarization bypass attempts tied to modified binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of modified binary without valid signature |
| File ModificationDC0061 | macos:unifiedlog | binary modified or replaced |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApplicationPaths | Tune which application and library directories are monitored for tampering |
| SignatureVerificationDepth | Define strictness of code-signing validation checks |
AN0952 · ESXi
Detects unauthorized modification of host binaries, modules, or services within ESXi. Correlates tampered files with subsequent unexpected service behavior or malicious module load attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | esxi:vmkernel | unexpected module load |
| File ModificationDC0061 | esxi:hostd | binary or module replacement event |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredModules | Define critical ESXi binaries and kernel modules requiring integrity validation |
| CorrelationWindow | Adjust timing correlation between binary modification and module/service anomalies |
Code SigningM1045
Ensure all application component binaries are signed by the correct application developers.