Cross-source coverage

T1195 / ATT&CK

Supply Chain Compromise

113 rules · 110 families across 8 sources.

4 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Supply chain compromise can take place at any stage of the supply chain including:

  • Manipulation of development tools
  • Manipulation of a development environment
  • Manipulation of source code repositories (public or private)
  • Manipulation of source code in open-source dependencies
  • Manipulation of software update/distribution mechanisms
  • Compromised/infected system images (removable media infected at the factory)
  • Replacement of legitimate software with modified versions
  • Sales of modified/counterfeit products to legitimate distributors
  • Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.

In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.

Tactics
Initial Access
Platforms
Linux · Windows · macOS · SaaS
Telemetry
WinEventLog:SysmonWinEventLog:Microsoft-Windows-CodeIntegrity/OperationalNSM:Flowauditd:SYSCALLjournald:packagemacos:unifiedlogmacos:osquerymacos:endpointsecurity

How MITRE says to detect it DET0537

Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)

Windows Analytic 1480

1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Microsoft-Windows-CodeIntegrity/Operational CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries
  • NSM:Flow First-time egress from host after new install to unknown update endpoints

Linux Analytic 1481

1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.

  • auditd:SYSCALL execve, unlink
  • auditd:SYSCALL open, rename
  • journald:package dpkg/apt install, remove, upgrade events
  • NSM:Flow First-time egress to unknown registries/mirrors immediately after install

macOS Analytic 1482

1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.

  • macos:unifiedlog installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer
  • macos:osquery launchd, processes
  • macos:endpointsecurity write, rename
  • NSM:Flow New egress from app just installed to unknown update endpoints

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 113 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

28 rules
Detection Severity Format
3CX Supply Chain Attack Network Indicators Undefined SPL
GitHub Enterprise Delete Branch Ruleset Undefined SPL
GitHub Enterprise Disable 2FA Requirement Undefined SPL
GitHub Enterprise Disable Audit Log Event Stream Undefined SPL
GitHub Enterprise Disable Classic Branch Protection Rule Undefined SPL
GitHub Enterprise Disable Dependabot Undefined SPL
GitHub Enterprise Disable IP Allow List Undefined SPL
GitHub Enterprise Modify Audit Log Event Stream Undefined SPL
GitHub Enterprise Pause Audit Log Event Stream Undefined SPL
GitHub Enterprise Register Self Hosted Runner Undefined SPL

+ 18 more from splunk/security_content → showing the 10 highest-severity

panther-labs/panther-analysis

27 rules
Detection Severity Format
A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094 High Panther Python
AWS EC2 Vulnerable XZ Image Launched High Panther Python
CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails High Panther Python
CVE-2023-7028 - GitLab Production Password Reset Multiple Emails High Panther Python
GitHub Branch Protection Disabled High Panther Python
GitHub Branch Protection Policy Override High Panther Python
GitHub Malicious Commit Content High Panther Python
GitHub Malicious Pull Request Content High Panther Python
GitHub pull_request_target Workflow on Self-Hosted Runner High Panther Python
GitHub pull_request_target Workflow Usage High Panther Python

+ 17 more from panther-labs/panther-analysis → showing the 10 highest-severity

SigmaHQ/sigma

19 rules
Detection Severity Format
Axios NPM Compromise File Creation Indicators - Linux High Sigma
Axios NPM Compromise File Creation Indicators - MacOS High Sigma
Axios NPM Compromise File Creation Indicators - Windows High Sigma
Axios NPM Compromise Indicators - Linux High Sigma
Axios NPM Compromise Indicators - macOS High Sigma
Axios NPM Compromise Indicators - Windows High Sigma
LiteLLM / TeamPCP Supply Chain Attack Indicators High Sigma
Octopus Scanner Malware High Sigma
Outdated Dependency Or Vulnerability Alert Disabled High Sigma
Shai-Hulud 2.0 Malicious NPM Package Installation High Sigma

+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

18 rules
Detection Severity Format
Elastic Defend Alert from GenAI Utility or Descendant Critical Elastic TOML
Elastic Defend Alert from Package Manager Install Ancestry Critical Elastic TOML
Network Connection to OAST Domain via Script Interpreter High Elastic TOML
Command Execution via SolarWinds Process Medium Elastic TOML
Execution via GitHub Actions Runner Medium Elastic TOML
GitHub Actions Workflow Modification Blocked Medium Elastic TOML
New GitHub Self Hosted Action Runner Medium Elastic TOML
Node.js Pre or Post-Install Script Execution Medium Elastic TOML
Remote GitHub Actions Runner Registration Medium Elastic TOML
SolarWinds Process Disabling Services via Registry Medium Elastic TOML

+ 8 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

16 rules · 13 families
Detection Severity Format
Application Javascript Injection via Nodejs Undefined Elastic TOML
Cursor Arbitrary Code Execution via PHP Undefined Elastic TOML
Discovery of GitHub Actions Runner Process PID Undefined Elastic TOML
Egress Network Connection from Default DPKG Directory Undefined Elastic TOML
Egress Network Connection from RPM Package Undefined Elastic TOML
GitHub Actions Runner with Disabled Telemetry Undefined Elastic TOML
Javascript Reverse Shell via Nodejs Undefined Elastic TOML
Nodejs Initial Access via VSCode Auto-run Task Undefined Elastic TOML
Potential Cloud Credential Harvesting via Bun 2 variants Undefined Elastic TOML
Potential Cloud Credential Harvesting via Bun 2 variants Undefined Elastic TOML

+ 6 more from elastic/protections-artifacts → showing the 10 highest-severity

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Solorigate Defender Detections High KQL
SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) High KQL

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Sysmon - Event 1: Process creation · javaw.exe Running Suspicious JAR from Temp (T1195) High Wazuh XML
Sysmon - Event 1: Process creation · Suspicious Scheduled Task Named ExplorerSync (T1195) High Wazuh XML

falcosecurity/rules

1 rule
Detection Severity Format
Network Tool Executed During NPM Package Install Medium Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.