AN0938
Analytic 0938
macOS
Correlation of package install event with execution of postinstall scripts containing unknown binaries or abnormal CLI usage. Look for `/usr/sbin/installer` execution followed by child processes originating from postinstall script.
macos:unifiedlog
Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents
macos:unifiedlog
Creation or modification of postinstall scripts within .pkg or .mpkg contents
[ScriptLocation]
Path to postinstall script varies depending on .pkg packaging and user temp directories.
[ParentProcessName]
Installers may vary (e.g., /usr/sbin/installer, Jamf, Munki).
AN0939
Analytic 0939
Linux
Detection of maintainer scripts (e.g., postinst, preinst) being modified or executed during dpkg or rpm operations. Watch for script content that spawns additional processes or writes outside package scope.
auditd:SYSCALL
Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc.
auditd:SYSCALL
write
[ScriptName]
May be postinst, preinst, prerm, or postrm depending on packaging system
[PackageManager]
Depends on system: dpkg, apt, rpm, yum, etc.
AN0940
Analytic 0940
Windows
Detection of msiexec.exe running installer packages that result in anomalous process creation. Look for unexpected binaries executed by msiexec or custom action DLLs in the temp directory.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[InstallerParent]
Could be msiexec.exe or third-party wrapper like setup.exe.
[ChildImagePath]
Payload paths vary based on where installer extracts to (e.g., %TEMP%, C:\Users\Public).
[ExecutionTimeWindow]
Threshold for how soon a payload must run after msiexec to be considered related.