Compromise Client Software Binary

Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.

Adversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.

ID: T1554
Sub-techniques:  No sub-techniques
Tactic: Persistence
Platforms: Linux, Windows, macOS
Data Sources: File: File Creation, File: File Deletion, File: File Metadata, File: File Modification
Contributors: CrowdStrike Falcon OverWatch
Version: 1.0
Created: 11 February 2020
Last Modified: 27 March 2020

Procedure Examples

ID Name Description
S0486 Bonadan

Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.[1]

S0377 Ebury

Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.[2]

S0487 Kessel

Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.[1]

S0595 ThiefQuest

ThiefQuest searches through the /Users/ folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior. [3][4]


ID Mitigation Description
M1045 Code Signing

Ensure all application component binaries are signed by the correct application developers.


Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment. Look for changes to client software that do not correlate with known software or patch cycles.

Consider monitoring for anomalous behavior from client applications, such as atypical module loads, file reads/writes, or network connections.