AN1480
Analytic 1480
Windows
1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=11
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries
NSM:Flow
First-time egress from host after new install to unknown update endpoints
[TimeWindow]
Correlation window between install events and first-run activity (default 2h; adjust for staged rollouts).
[TrustedPublishers]
Publisher/Signer allow-list to suppress expected updates.
[TrustedUpdateHosts]
Known update CDNs/APIs (e.g., download.microsoft.com) to reduce egress false positives.
[RiskScoreThreshold]
Score cut-off for alerting when combining path, signer, and reputation features.
AN1481
Analytic 1481
Linux
1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.
auditd:SYSCALL
execve, unlink
auditd:SYSCALL
open, rename
journald:package
dpkg/apt install, remove, upgrade events
NSM:Flow
First-time egress to unknown registries/mirrors immediately after install
[ApprovedRepos]
Allow-listed APT/YUM repo URLs and GPG key fingerprints.
[PathScope]
Directories to watch for new ELF writes (e.g., /usr/bin, /usr/local/bin, /lib*/, /opt/*/bin).
[MinBinarySize]
Ignore tiny helper files; default >16KB.
[TimeWindow]
Install→first-run correlation window (default 2h).
AN1482
Analytic 1482
macOS
1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.
macos:unifiedlog
installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer
macos:osquery
launchd, processes
macos:endpointsecurity
write, rename
NSM:Flow
New egress from app just installed to unknown update endpoints
[AllowedTeamIDs]
Apple Developer Team IDs permitted in your fleet.
[TrustedDMGs]
Known DMG/Pkg sources and hashes.
[TimeWindow]
Install→first-run correlation window (default 2h).
[RiskScoreThreshold]
Adjust alert sensitivity based on org tolerance.