Binary Planting & Execution Hijacking
Detects techniques for replacing or shadowing legitimate system binaries with malicious versions
7 rules in binary_planting.yml
CRITICAL: 2 | HIGH: 5
| Rule ID | Severity | Title | Description | Refs |
|---|---|---|---|---|
binary_ | CRITICAL | System Binary Replacement | Copies or writes a file to system binary directories, potentially replacing a legitimate binary | |
path_ | CRITICAL | Trojan Binary in Early PATH Directory | Places a binary in a directory that appears before system paths, shadowing legitimate commands | |
alias_ | HIGH | Shell Alias Command Hijacking | Creates shell aliases that override system commands, potentially intercepting sensitive input | |
function_ | HIGH | Shell Function Command Hijacking | Defines a shell function that shadows a system binary (sudo/su/ssh/docker/kubectl/aws/gcloud/az). A planted function intercepts privileged commands and is a classic persistence trick on shared shells. | |
git_ | HIGH | Git Hook Injection | Writes to git hook directories, which auto-execute on git operations | |
npm_ | HIGH | Global npm Install from Untrusted Source | Installs npm packages globally from URLs or local paths instead of the registry | |
pip_ | HIGH | pip Install from Local Editable Path | Installs a Python package in editable mode from a suspicious local path |