T1195 Supply Chain Compromise

initial access — Linux, Windows, macOS, SaaS · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1195

KEV CVEs mapped here

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.Supply chain compromise can take place at any stage of the supply chain including:

<li>Manipulation of development tools</li><li>Manipulation of a development environment</li><li>Manipulation of source code repositories (public or private)</li><li>Manipulation of source code in open-source dependencies</li><li>Manipulation of software update/distribution mechanisms</li><li>Compromised/infected system images (removable media infected at the factory) </li><li>Replacement of legitimate software with modified versions</li><li>Sales of modified/counterfeit products to legitimate distributors</li><li>Shipment interdiction</li>While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims. Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component. This may allow the threat actor to spread to even more victims.

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2024-49035	Microsoft Partner Center	primary impact	Mapped	2025-02-25

Detection strategy · ATT&CK Enterprise v19.2

DET0537 Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run) v1.0
AN1480 Windows
1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries → DC0059 File Metadata
NSM:Flow First-time egress from host after new install to unknown update endpoints → DC0078 Network Traffic Flow

Tunable: TimeWindow TrustedPublishers TrustedUpdateHosts RiskScoreThreshold

AN1481 Linux
1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.

auditd:SYSCALL execve, unlink → DC0032 Process Creation
auditd:SYSCALL open, rename → DC0020 Process Modification
journald:package dpkg/apt install, remove, upgrade events → DC0059 File Metadata
NSM:Flow First-time egress to unknown registries/mirrors immediately after install → DC0078 Network Traffic Flow

Tunable: ApprovedRepos PathScope MinBinarySize TimeWindow

AN1482 macOS
1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.

macos:unifiedlog installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer → DC0059 File Metadata
macos:osquery launchd, processes → DC0032 Process Creation
macos:endpointsecurity write, rename → DC0061 File Modification
NSM:Flow New egress from app just installed to unknown update endpoints → DC0078 Network Traffic Flow

Tunable: AllowedTeamIDs TrustedDMGs TimeWindow RiskScoreThreshold

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1195`

Octopus Scanner Malware hightest

Author: NVISO · 2020-06-09 (modified 2021-11-27) · logsource: product=windows category=file_event · 805c55d9-31e6-4846-9878-c34c75054fe9

Detects Octopus Scanner Malware.

Techniques: T1195 T1195.001

Sub-techniques

ID	Name	Sigma rules	KEV CVEs
T1195.001	Compromise Software Dependencies and Development Tools	2	0
T1195.002	Compromise Software Supply Chain	17	2
T1195.003	Compromise Hardware Supply Chain	0	0

T1195 Supply Chain Compromise

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1195

Sub-techniques

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1195`