Installer Package abuse (MITRE ATT&CK T1546.016) uses the install process itself as the trigger. Installer packages are specific to each operating system and hold what is needed to install an application. They can include scripts that run before installation and after it finishes.
This one is a supply chain concern as much as a host one, because the package usually arrives from somewhere else.
How attackers use it
Developers use install scripts to prepare the environment, check requirements, download dependencies and clean up. These scripts can inherit elevated permissions.
MITRE describes adversaries distributing legitimate applications with modified installer scripts. A user installs the application and may be asked to grant administrator rights. At the end of the install, content such as a macOS postinstall script can run with those inherited rights, and may execute a malicious file or set up other components, such as a Launch Daemon (T1543.004).
The details differ by platform:
- Linux. Package installer scripts are sometimes called maintainer scripts or post installation scripts. They include
preinst,postinst,prermandpostrm, and they run as root. - macOS. Packages can run scripts such as
postinstallwith the permissions the installer was granted. - Windows. The Microsoft Installer service uses
.msifiles to install, update and remove applications, and those routines can include extra actions that adversaries may abuse.
How to detect it
MITRE gives separate analytics per platform:
- macOS. Correlate a package install event, the execution of
/usr/sbin/installer, and child processes that come from the postinstall script, especially with unknown binaries or abnormal command line use. - Linux. Watch for maintainer scripts such as postinst and preinst being modified or run during dpkg or rpm operations, and for script content that starts extra processes or writes outside the package scope.
- Windows. Watch msiexec.exe runs that lead to unexpected process creation, such as unexpected binaries or custom action DLLs in the temp directory.
How to reduce the risk
MITRE lists no mitigations for this sub-technique. The practical controls sit before the install:
- Install only from sources you trust, and verify package integrity and signatures.
- Inventory what packages and dependencies you actually deploy, so a modified or unexpected one stands out.
- Review installer scripts for packages that ship to many machines.
- Do not give an installer more privilege than the task requires.
For application dependencies, you can check a manifest in the browser with the free Safeguard Gold scan. No login is needed, the file never leaves your machine, and it covers up to 100 dependencies.
Check your own environment
Read-only commands, labeled by system:
# Debian and Ubuntu: recently changed maintainer scripts
ls -lt /var/lib/dpkg/info/*.postinst | head -20
# RPM based Linux: view scripts for one installed package
rpm -q --scripts packagename
# macOS: list installed package receipts
pkgutil --pkgs
Replace packagename with a real package. Look for scripts that download content, start network connections or write outside the package's own paths.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do installer scripts matter for privilege escalation?
They can inherit the elevated permissions granted for the install, so a malicious script runs with those permissions.
Name the Linux maintainer scripts MITRE lists.
preinst, postinst, prerm and postrm, which run as root when executed.
