AN0021
Analytic 0021
Windows
Adversary manipulates dependencies/dev tools used by developers or CI: a package manager (npm/yarn/pnpm, pip/pipenv, nuget/dotnet, chocolatey/winget, maven/gradle) or a compiler/IDE downloads or restores content; files are written under project paths and execution paths (node_modules, packages, .nuget, .gradle, .m2, %AppData%\npm, %UserProfile%\.cargo\bin, temp build dirs). First run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning, or loader DLLs, followed by network egress to non-approved registries/CDNs.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=13, 14
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Invalid/Unsigned image when developer tool launches newly installed binaries
NSM:Flow
First-time outbound connections to package registries or unknown hosts immediately after restore/build
[TimeWindow]
Correlate file write by package manager to first execution and egress (default 90 minutes).
[ApprovedRegistries]
Allow-listed registries (e.g., registry.npmjs.org, pypi.org, nuget.org, maven.apache.org, company proxies/CDNs).
[DevHosts]
Limit analytics to engineering endpoints/CI agents to reduce noise.
[TrustedPublishers]
Code-signing publishers acceptable for dev tools.
AN0022
Analytic 0022
Linux
Developer or CI invokes package managers/compilers (apt/yum + build-essential, npm/yarn/pnpm, pip/pip3, gem, cargo, go, maven/gradle). These write executable or script files into PATH or project dirs and immediately execute embedded lifecycle hooks (preinstall/postinstall, setup.py, npm scripts) that spawn shells or curl/wget, followed by egress to unfamiliar registries or domains.
auditd:SYSCALL
execve
auditd:SYSCALL
rename, chmod
journald:package
dpkg/apt or yum/dnf transaction logs (install/update of build tools)
NSM:Flow
First-time egress to new registries/CDNs post-install/build
[ApprovedRepos]
Allowed APT/YUM repos and GPG keys for build tools.
[PathScope]
Monitor /usr/local/bin, /usr/bin, /opt/*/bin, ~/.local/bin, node_modules/.bin, .venv/bin, .cargo/bin, .gradle, .m2.
[TimeWindow]
Default 90 minutes for write→exec→egress linkage.
AN0023
Analytic 0023
macOS
Developer tools (Homebrew, pip, npm/yarn, Xcode builds) install or update dependencies; new Mach-O or scripts appear under /usr/local, /opt/homebrew, ~/Library/Application Support, project dirs (node_modules/.bin, venv/bin). First run spawns sh/zsh/osascript/curl and new outbound flows; Gatekeeper/AMFI may flag unsigned components.
macos:unifiedlog
softwareupdated/homebrew/install logs, pkginstalld events
macos:endpointsecurity
exec
NSM:Flow
First-time egress to non-approved registries after dependency install
[AllowedTeamIDs]
Apple Developer Team IDs for approved dev tools (Xcode, JetBrains, etc.).
[BrewTapsAllowList]
Homebrew taps allowed in your environment.
[TimeWindow]
Default 90 minutes.