Correlation of package install event with execution of postinstall scripts containing unknown binaries or abnormal CLI usage. Look for /usr/sbin/installer execution followed by child processes originating from postinstall script.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents |
| File Creation (DC0039) | macos:unifiedlog | Creation or modification of postinstall scripts within .pkg or .mpkg contents |
| Field | Description |
|---|---|
| ScriptLocation | Path to postinstall script varies depending on .pkg packaging and user temp directories. |
| ParentProcessName | Installers may vary (e.g., /usr/sbin/installer, Jamf, Munki). |
Detection of maintainer scripts (e.g., postinst, preinst) being modified or executed during dpkg or rpm operations. Watch for script content that spawns additional processes or writes outside package scope.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc. |
| File Creation (DC0039) | auditd:SYSCALL | write |
| Field | Description |
|---|---|
| ScriptName | May be postinst, preinst, prerm, or postrm depending on packaging system |
| PackageManager | Depends on system: dpkg, apt, rpm, yum, etc. |
Detection of msiexec.exe running installer packages that result in anomalous process creation. Look for unexpected binaries executed by msiexec or custom action DLLs in the temp directory.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Field | Description |
|---|---|
| InstallerParent | Could be msiexec.exe or third-party wrapper like setup.exe. |
| ChildImagePath | Payload paths vary based on where installer extracts to (e.g., %TEMP%, C:\Users\Public). |
| ExecutionTimeWindow | Threshold for how soon a payload must run after msiexec to be considered related. |