Home/ATT&CK Technique/Malicious Library
ATT&CK Technique

Malicious Library

T1204.005 · execution

Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access.

This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency. In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.

LinuxmacOSWindows
▣

Mitigations

3
MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.
M1017User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses.

Create Comprehensive Training Programs
  • Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting.
  • Provide role-specific training for high-risk employees, such as helpdesk staff or executives.
Use Simulated Exercises
  • Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training.
  • Run social engineering drills to evaluate employee responses and reinforce protocols.
Leverage Gamification and Engagement
  • Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.
Incorporate Security Policies into Onboarding
  • Include cybersecurity training as part of the onboarding process for new employees.
  • Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.
Regular Refresher Courses
  • Update training materials to include emerging threats and techniques used by adversaries.
  • Ensure all employees complete periodic refresher courses to stay informed.
Emphasize Real-World Scenarios
  • Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering.
  • Discuss how specific employee actions can prevent or mitigate such attacks.
M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

M1033Limit Software Installation

Prevent users or groups from installing unauthorized or unapproved software to reduce the risk of introducing malicious or vulnerable applications. This can be achieved through allowlists, software restriction policies, endpoint management tools, and least privilege access principles.

Application Whitelisting
  • Implement Microsoft AppLocker or Windows Defender Application Control (WDAC) to create and enforce allowlists for approved software.
  • Whitelist applications based on file hash, path, or digital signatures. Restrict User Permissions.
  • Remove local administrator rights for all non-IT users.
  • Use Role-Based Access Control (RBAC) to restrict installation permissions to privileged accounts only. Software Restriction Policies (SRP)
  • Use GPO to configure SRP to deny execution of binaries from directories such as %AppData%, %Temp%, and external drives.
  • Restrict specific file types (.exe, .bat, .msi, .js, .vbs) to trusted directories only. Endpoint Management Solutions.
  • Deploy tools like Microsoft Intune, SCCM, or Jamf for centralized software management.
  • Maintain a list of approved software, versions, and updates across the enterprise. Monitor Software Installation Events.
  • Enable logging of software installation events and monitor Windows Event ID 4688 and Event ID 11707 for software installs.
  • Use SIEM or EDR tools to alert on attempts to install unapproved software. Implement Software Inventory Management.
  • Use tools like OSQuery or Wazuh to scan for unauthorized software on endpoints and servers.
  • Conduct regular audits to detect and remove unapproved software.
Tools for Implementation Application Whitelisting
  • Microsoft AppLocker.
Windows Defender Application Control (WDAC) Endpoint Management
  • Microsoft Intune.
  • SCCM (System Center Configuration Manager)
  • Jamf Pro (macOS)
Puppet or Ansible for automation Software Restriction Policies
  • Group Policy Object (GPO)
Microsoft Software Restriction Policies (SRP) Monitoring and Logging
  • Splunk.
  • OSQuery.
  • Wazuh (open-source SIEM and XDR)
EDRs Inventory Management and Auditing
  • OSQuery.
  • Wazuh.
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin