T1204.005sub-technique of T1204 User Execution
Malicious Library
Linux · macOS · Windowsnothing on this site yetT1204.005 on attack.mitre.org
Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
User-Initiated Malicious Library Installation via Package Manager (T1204.005)
- User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications.
- Execution of `pip.exe`, `npm.cmd`, or MSI installers within user context, followed by script interpreter startup (e.g., python.exe) or PowerShell with unusual child processes or file writes in `%APPDATA%`, `%TEMP%`, or `%LOCALAPPDATA%`.
- Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains.
what reduces it
- M1031 Network Intrusion Prevention. Network prevention intrusion systems and systems designed to scan and remove malicious downloads can be used to block activity.
- M1033 Limit Software Installation. Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
- M1017 User Training. Train developers to be aware of the existence of malicious libraries and how to avoid installing them.