Cross-source coverage

T1195.001 / ATT&CK

Supply Chain Compromise: Compromise Software Dependencies and Development Tools

22 rules · 19 families across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.

Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application. By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via Proc Filesystem) or insert further malicious components into the build pipelines for a second-order supply chain compromise. As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.

Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Tactics
Initial Access
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Microsoft-Windows-CodeIntegrity/OperationalNSM:Flowauditd:SYSCALLjournald:packagemacos:unifiedlogmacos:endpointsecurity

How MITRE says to detect it DET0009

Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)

Windows Analytic 0021

Adversary manipulates dependencies/dev tools used by developers or CI: a package manager (npm/yarn/pnpm, pip/pipenv, nuget/dotnet, chocolatey/winget, maven/gradle) or a compiler/IDE downloads or restores content; files are written under project paths and execution paths (node_modules, packages,.nuget,.gradle,.m2, %AppData%\npm, %UserProfile%\.cargo\bin, temp build dirs). First run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning, or loader DLLs, followed by network egress to non-approved registries/CDNs.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:Microsoft-Windows-CodeIntegrity/Operational Invalid/Unsigned image when developer tool launches newly installed binaries
  • NSM:Flow First-time outbound connections to package registries or unknown hosts immediately after restore/build

Linux Analytic 0022

Developer or CI invokes package managers/compilers (apt/yum + build-essential, npm/yarn/pnpm, pip/pip3, gem, cargo, go, maven/gradle). These write executable or script files into PATH or project dirs and immediately execute embedded lifecycle hooks (preinstall/postinstall, setup.py, npm scripts) that spawn shells or curl/wget, followed by egress to unfamiliar registries or domains.

  • auditd:SYSCALL execve
  • auditd:SYSCALL rename, chmod
  • journald:package dpkg/apt or yum/dnf transaction logs (install/update of build tools)
  • NSM:Flow First-time egress to new registries/CDNs post-install/build

macOS Analytic 0023

Developer tools (Homebrew, pip, npm/yarn, Xcode builds) install or update dependencies; new Mach-O or scripts appear under /usr/local, /opt/homebrew, ~/Library/Application Support, project dirs (node_modules/.bin, venv/bin). First run spawns sh/zsh/osascript/curl and new outbound flows; Gatekeeper/AMFI may flag unsigned components.

  • macos:unifiedlog softwareupdated/homebrew/install logs, pkginstalld events
  • macos:endpointsecurity exec
  • NSM:Flow First-time egress to non-approved registries after dependency install

View on attack.mitre.org ↗

elastic/protections-artifacts

13 rules · 10 families
Detection Severity Format
Application Javascript Injection via Nodejs Undefined Elastic TOML
Cursor Arbitrary Code Execution via PHP Undefined Elastic TOML
Discovery of GitHub Actions Runner Process PID Undefined Elastic TOML
GitHub Actions Runner with Disabled Telemetry Undefined Elastic TOML
Javascript Reverse Shell via Nodejs Undefined Elastic TOML
Nodejs Initial Access via VSCode Auto-run Task Undefined Elastic TOML
Potential Cloud Credential Harvesting via Bun 2 variants Undefined Elastic TOML
Potential Cloud Credential Harvesting via Bun 2 variants Undefined Elastic TOML
Potential Execution via VS Code Tasks 2 variants Undefined Elastic TOML
Potential Execution via VS Code Tasks 2 variants Undefined Elastic TOML

+ 3 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

5 rules
Detection Severity Format
Network Connection to OAST Domain via Script Interpreter High Elastic TOML
GitHub Actions Workflow Modification Blocked Medium Elastic TOML
New GitHub Self Hosted Action Runner Medium Elastic TOML
Node.js Pre or Post-Install Script Execution Medium Elastic TOML
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners Medium Elastic TOML

SigmaHQ/sigma

2 rules
Detection Severity Format
Octopus Scanner Malware High Sigma
Outdated Dependency Or Vulnerability Alert Disabled High Sigma

panther-labs/panther-analysis

2 rules
Detection Severity Format
A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094 High Panther Python
AWS EC2 Vulnerable XZ Image Launched High Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.