Techniques › T1195 › T1195.003
T1195.003 Compromise Hardware Supply Chain
initial access — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1195.003
0
KEV CVEs mapped here
<p>Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0368 Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks v1.0
AN1035 WindowsDetects tampered hardware or firmware via anomalous host status telemetry. Behavioral chain: (1) Pre-OS or firmware components exhibit unexpected version changes, signature failures, or modified boot paths; (2) System management/firmware tools log hardware inventory drift; (3) Sensor health telemetry or boot attestation events fail baseline checks; (4) Follow-on process execution from altered firmware or unknown drivers after boot.WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Code integrity violations in boot-start drivers or firmware→ DC0059 File MetadataTunable:BaselineFirmwareVersionBaselineDriverListIntegrityCheckIntervalAN1036 LinuxMonitors for hardware or firmware tampering by correlating system boot logs, hardware inventory changes, and secure boot/firmware verification failures. Behavioral chain: (1) UEFI/BIOS version drift; (2) secure boot disabled or signature verification errors; (3) unexpected modules or hardware devices enumerated at boot; (4) new device firmware images loaded from non-approved sources.Tunable:ApprovedFirmwareHashesAllowedDeviceIDsAN1037 macOSDetects tampered Mac hardware/firmware by analyzing unified logs, EndpointSecurity events, and Apple Mobile File Integrity (AMFI) checks. Behavioral chain: (1) Boot process reports firmware signature mismatch; (2) Secure Boot policy altered; (3) new EFI drivers or hardware devices appear in inventory; (4) system extension loads from unapproved developer IDs post-boot.Tunable:AllowedTeamIDsFirmwareVersionBaseline
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1195.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1195) 1
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: NVISO
· 2020-06-09 (modified 2021-11-27) · logsource: product=windows category=file_event · 805c55d9-31e6-4846-9878-c34c75054fe9
Detects Octopus Scanner Malware.