Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

DPKG Package Installed by Unusual Parent Process

This rule detects the installation of a Debian package (dpkg) by an unusual parent process. The dpkg command is used to install, remove, and manage Debian packages on a Linux system. Attackers can abuse the dpkg command to install malicious packages on a system.

ATT&CK coverage

Initial Access

T1195Supply Chain Compromise40 detections cover this technique
- T1195.002Compromise Software Supply Chain 27 detections cover this technique

Execution

T1574Hijack Execution FlowAlso under Stealth.88 detections cover this technique

Persistence

Detection requirements

Log source category: event_index

What the source says

References

https://www.makeuseof.com/how-deb-packages-are-backdoored-how-to-detect-it/

Tagged by the source as

Data Source: Elastic DefendDomain: EndpointOS: LinuxResources: Investigation GuideTactic: PersistenceUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.