MITRE ATT&CK technique
Compromise Host Software Binary detection rulesT1554
Compromise Host Software Binary (T1554) is a MITRE ATT&CK technique in the Persistence tactic. This page lists the 6 community-maintained Sigma detection rules in the library mapped to T1554 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux.
Tactic
DNS HybridConnectionManager Service Bus
highDetects Azure Hybrid Connection Manager services querying the Azure service bus service
windows · dns_query
HybridConnectionManager Service Installation
highRule to detect the Hybrid Connection Manager service installation.
windows
HybridConnectionManager Service Running
highRule to detect the Hybrid Connection Manager service running on an endpoint.
windows
TanStack Supply-Chain Attack File Creation Indicators - Windows
mediumDetects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
windows · file_event
Linux Setgid Capability Set on a Binary via Setcap Utility
lowDetects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
linux · process_creation
Linux Setuid Capability Set on a Binary via Setcap Utility
lowDetects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
linux · process_creation