AN0698
Analytic 0698
Linux
User-initiated installation of Python (pip), NodeJS (npm), or other language libraries, followed by unexpected network connections, credential access, or startup file modifications. Defender sees `pip install` or `npm install` commands run by a non-root user, followed shortly by new `.py`, `.sh`, or `.js` files in hidden directories, or interpreter-based execution during boot/login.
auditd:SYSCALL
execve: Execution of pip, npm, gem, or similar package managers
auditd:PATH
New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install
NSM:Flow
http::request: Network connection to package registry or C2 from interpreter shortly after install
[PackageManagerList]
Monitored package managers (e.g., pip, npm, gem, poetry, conda)
[InstallWritePaths]
Directories to watch for post-install execution artifacts (e.g., ~/.local/, /usr/lib/python3.8/site-packages/)
[UserContextScope]
Filter to focus on non-system accounts (e.g., interactive shell users)
[TimeWindow]
Correlate install command to subsequent network/file activity (default: 5 min)
AN0699
Analytic 0699
Windows
Execution of `pip.exe`, `npm.cmd`, or MSI installers within user context, followed by script interpreter startup (e.g., python.exe) or PowerShell with unusual child processes or file writes in `%APPDATA%`, `%TEMP%`, or `%LOCALAPPDATA%`. Defender correlates command-line install tools with Sysmon and Event Logs to trace downstream behavior.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[AllowedParentProcesses]
Filter expected automation tools (e.g., enterprise installers, known IDEs)
[InstallPathsToWatch]
Suspicious post-install write paths (e.g., %APPDATA%, %TEMP%)
[ExecutableEntropyThreshold]
Used for evaluating if dropped files are packed/obfuscated
AN0700
Analytic 0700
macOS
Execution of Homebrew, pip3, npm, or manually downloaded PKGs from Terminal or shell, followed by the creation of startup agents, interpreter spawns, or outbound connections to unfamiliar domains. Defender links Terminal commands to plist creation, unsigned binary launches, and `python3` or `node` processes connecting to remote endpoints.
macos:unifiedlog
Command line invocation of pip3, brew install, npm install from interactive Terminal
macos:unifiedlog
Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/
NSM:Flow
Outbound HTTP/S initiated by newly installed interpreter process
[StartupAgentPaths]
Filter user persistence plist directories like ~/Library/LaunchAgents
[UnsignedBinaryAlerting]
Enable alerting for new binaries lacking Apple or organization signature
[InstallToNetWindow]
Correlate install action to interpreter-based network behavior