Detect Installer Packages in IBM QRadar
Adversaries may establish persistence and elevate privileges by using an installer package to execute malicious content. Installer packages are setup utilities for applications bundled with an installer utility and can be distributed through legitimate channels. Malicious code can be embedded within installer packages to create backdoors and establish persistence. Installer utilities such as msiexec.exe (Windows MSI), macOS pkgutil, and Linux dpkg/rpm allow adversaries to run pre-install and post-install scripts. These scripts can execute arbitrary code with elevated privileges during the installation process. Additionally, malicious code within the installer can establish persistence by deploying backdoors as scheduled tasks, services, or startup items.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.016 Installer Packages
- Canonical reference
- https://attack.mitre.org/techniques/T1546/016/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceIP,
username AS Username,
LOGSOURCENAME(logsourceid) AS LogSource,
QIDNAME(qid) AS EventName,
"ParentProcessPath" AS ParentProcess,
"ProcessPath" AS ChildProcess,
"CommandLine" AS CommandLine,
CASE
WHEN LOWER("CommandLine") ILIKE '%invoke-webrequest%'
OR LOWER("CommandLine") ILIKE '%downloadstring%'
OR LOWER("CommandLine") ILIKE '%net.webclient%' THEN 'INSTALLER_DOWNLOAD_CRADLE'
WHEN LOWER("CommandLine") ILIKE '%-encodedcommand%'
OR LOWER("CommandLine") ILIKE '%certutil%urlcache%'
OR LOWER("CommandLine") ILIKE '%bitsadmin%transfer%' THEN 'INSTALLER_ENCODED_EXECUTION'
WHEN LOWER("ProcessPath") ILIKE '%powershell%'
OR LOWER("ProcessPath") ILIKE '%cmd.exe%'
OR LOWER("ProcessPath") ILIKE '%wscript%'
OR LOWER("ProcessPath") ILIKE '%bash%'
OR LOWER("ProcessPath") ILIKE '%python%' THEN 'INSTALLER_SCRIPT_CHILD'
ELSE 'INSTALLER_NETWORK_CALLBACK'
END AS DetectionType
FROM events
WHERE LOGSOURCETYPEID IN (12, 14, 352)
AND (
(
(
LOWER("ParentProcessPath") ILIKE '%msiexec.exe%'
OR LOWER("ParentProcessPath") ILIKE '%installer%'
OR LOWER("ParentProcessPath") ILIKE '%dpkg%'
OR LOWER("ParentProcessPath") ILIKE '%rpm%'
OR LOWER("ParentProcessPath") ILIKE '%pkgutil%'
OR LOWER("ParentProcessPath") ILIKE '%chocolatey%'
OR LOWER("ParentProcessPath") ILIKE '%winget%'
)
AND (
LOWER("ProcessPath") ILIKE '%powershell.exe%'
OR LOWER("ProcessPath") ILIKE '%pwsh.exe%'
OR LOWER("ProcessPath") ILIKE '%cmd.exe%'
OR LOWER("ProcessPath") ILIKE '%wscript.exe%'
OR LOWER("ProcessPath") ILIKE '%cscript.exe%'
OR LOWER("ProcessPath") ILIKE '%mshta.exe%'
OR LOWER("ProcessPath") ILIKE '%certutil.exe%'
OR LOWER("ProcessPath") ILIKE '%bitsadmin.exe%'
OR LOWER("ProcessPath") ILIKE '%bash%'
OR LOWER("ProcessPath") ILIKE '%python%'
)
)
OR (
(
LOWER("ParentProcessPath") ILIKE '%msiexec.exe%'
OR LOWER("ParentProcessPath") ILIKE '%installer%'
)
AND (
LOWER("CommandLine") ILIKE '%invoke-webrequest%'
OR LOWER("CommandLine") ILIKE '%downloadstring%'
OR LOWER("CommandLine") ILIKE '%net.webclient%'
OR LOWER("CommandLine") ILIKE '%-encodedcommand%'
OR LOWER("CommandLine") ILIKE '%certutil%urlcache%'
OR LOWER("CommandLine") ILIKE '%bitsadmin%transfer%'
)
)
)
LAST 24 HOURS
ORDER BY starttime DESCQRadar AQL query correlating Windows Security (LOGSOURCETYPEID 12), Sysmon (LOGSOURCETYPEID 14), and Linux audit (LOGSOURCETYPEID 352) events to detect installer parent processes spawning script interpreters or executing download cradles. Classifies findings into INSTALLER_DOWNLOAD_CRADLE, INSTALLER_ENCODED_EXECUTION, INSTALLER_SCRIPT_CHILD, and INSTALLER_NETWORK_CALLBACK categories matching the SPL DetectionType taxonomy.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise application suites (SAP, Oracle, Salesforce desktop) using PowerShell custom actions in MSI installers for license validation and service registration at elevated privilege
- Configuration management tools (SCCM, Ansible WinRM modules, Puppet) triggering MSI deployments that chain into PowerShell for environment and dependency setup
- Developer SDK installers (Python, Node.js, .NET SDK, JDK) executing cmd.exe or PowerShell to update PATH environment variables and register shell extensions
Other platforms for T1546.016
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1MSI Custom Action Spawning PowerShell
Expected signal: Process creation for msiexec.exe. Subsequent process creation for powershell.exe. The parent-child relationship (msiexec -> powershell) combined with the powershell command line arguments is the detection trigger.
- Test 2Package Manager Post-Install Script with Network Call
Expected signal: Process creation for pip install. Child process for python executing setup.py post-install hook. Child process for curl with the callback URL. The pip->python->curl chain is the detection signal.
- Test 3MSI Silent Installation with Custom Action Tracking
Expected signal: Process creation for msiexec.exe or cmd.exe spawned from installer context. File creation for custom_action_test.txt. Windows Installer Application event log entries for custom action execution.
References (5)
- https://attack.mitre.org/techniques/T1546/016/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.016/T1546.016.md
- https://docs.microsoft.com/en-us/windows/win32/msi/custom-actions
- https://arstechnica.com/information-technology/2022/01/researchers-find-hundreds-of-compromised-npm-packages-stealing-data/
- https://unit42.paloaltonetworks.com/atoms/supply-chain-compromise/
Unlock Pro Content
Get the full detection package for T1546.016 including response playbook, investigation guide, and atomic red team tests.