Supply Chain Compromise T1195
Tactic: Initial Access
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Events covered
19 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
| Sysmon | Event ID 23 | FileDelete (File Delete archived) |
| Sysmon | Event ID 26 | FileDeleteDetected (File Delete logged) |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceFileEvents | any | File activity |
| Defender-DeviceInfo | any | Device information |
| Defender-DeviceNetworkEvents | ConnectionSuccess | Connection succeeded |
| ESF | exec | Process Execution |
| ESF | create | File or Directory Create |
| ESF | write | File Write |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
These 119 rules share fields, values, and exclusions.
Fields filtered most (84 distinct)
These fields appear most often in rule filters.
Top indicator values (1697 distinct)
These values appear most often in rule predicates.
Exclusions (177 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 19 rules
- Axios NPM Compromise File Creation Indicators - Linux
- Axios NPM Compromise File Creation Indicators - MacOS
- Axios NPM Compromise File Creation Indicators - Windows
- Axios NPM Compromise Indicators - Linux
- Axios NPM Compromise Indicators - macOS
- Axios NPM Compromise Indicators - Windows
- LiteLLM / TeamPCP Supply Chain Attack Indicators
- Notepad++ Updater DNS Query to Uncommon Domains
- Octopus Scanner Malware
- Outdated Dependency Or Vulnerability Alert Disabled
- Shai-Hulud 2.0 Malicious NPM Package Installation
- Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
- Shai-Hulud Malicious Bun Execution
- Shai-Hulud Malicious Bun Execution - Linux
- Suspicious Child Process of Notepad++ Updater - GUP.Exe
- TanStack Supply-Chain Attack File Creation Indicators - Linux
- TanStack Supply-Chain Attack File Creation Indicators - Windows
- TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
- Uncommon File Created by Notepad++ Updater Gup.EXE
Elastic 35 rules
- Application Javascript Injection via Nodejs
- Command Execution via SolarWinds Process
- Cursor Arbitrary Code Execution via PHP
- Discovery of GitHub Actions Runner Process PID
- DPKG Package Installed by Unusual Parent Process
- Egress Network Connection from Default DPKG Directory
- Egress Network Connection from RPM Package
- Elastic Defend Alert from GenAI Utility or Descendant
- Elastic Defend Alert from Package Manager Install Ancestry
- Execution via GitHub Actions Runner
- GitHub Actions Runner with Disabled Telemetry
- GitHub Actions Unusual Bot Push to Repository
- GitHub Actions Workflow Modification Blocked
- Github Activity on a Private Repository from an Unusual IP
- Javascript Reverse Shell via Nodejs
- Network Connection to OAST Domain via Script Interpreter
- New GitHub Self Hosted Action Runner
- Node.js Pre or Post-Install Script Execution
- Nodejs Initial Access via VSCode Auto-run Task
- Ollama DNS Query to Untrusted Domain
- Potential Cloud Credential Harvesting via Bun
- Potential Cloud Credential Harvesting via Bun
- Potential Execution via VS Code Tasks
- Potential Execution via VS Code Tasks
- Remote GitHub Actions Runner Registration
- RPM Package Installed by Unusual Parent Process
- SolarWinds Process Disabling Services via Registry
- Suspicious Execution from VS Code Extension
- Suspicious SolarWinds Child Process
- Suspicious Terraform Provider Execution and Network Connection
- Suspicious TruffleHog Execution via NodeJS
- Suspicious TruffleHog Execution via NodeJS
- Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners
- Unusual DPKG Execution
- VScode Project File Infection via Osascript
Splunk 30 rules
- 3CX Supply Chain Attack Network Indicators
- 3CXDesktopApp.exe Execution (Sysmon)
- 3CXDesktopApp.exe Execution (Windows Event Log)
- GitHub Enterprise Delete Branch Ruleset
- GitHub Enterprise Disable 2FA Requirement
- GitHub Enterprise Disable Audit Log Event Stream
- GitHub Enterprise Disable Classic Branch Protection Rule
- GitHub Enterprise Disable Dependabot
- GitHub Enterprise Disable IP Allow List
- GitHub Enterprise Modify Audit Log Event Stream
- GitHub Enterprise Pause Audit Log Event Stream
- GitHub Enterprise Register Self Hosted Runner
- GitHub Enterprise Remove Organization
- GitHub Enterprise Repository Archived
- GitHub Enterprise Repository Deleted
- GitHub Organizations Delete Branch Ruleset
- GitHub Organizations Disable 2FA Requirement
- GitHub Organizations Disable Classic Branch Protection Rule
- GitHub Organizations Disable Dependabot
- GitHub Organizations Repository Archived
- GitHub Organizations Repository Deleted
- GitHub Workflow File Creation or Modification
- Hunting 3CXDesktopApp Software
- Python Network Traffic During Package Build
- Python PTH File Creation During Package Installation
- Python PYTHONPATH Modification During Package Installation
- Python Site Hooks Creation During Package Installation
- Shai-Hulud 2 Exfiltration Artifact Files
- Shai-Hulud Workflow File Creation or Modification
- Windows Vulnerable 3CX Software
Kusto 8 rules
- Google DNS - Malicous Python packages
- McAfee ePO - Multiple threats on same host
- McAfee ePO - Threat was not blocked
- SAP BTP - Cloud Integration package import or transport
- Solorigate Defender Detections
- SUNBURST and SUPERNOVA backdoor hashes
- SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
- SUNBURST network beacons
Panther 27 rules
- A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094
- Action Performed by Netskope Personnel
- AWS EC2 Vulnerable XZ Image Launched
- CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails
- CVE-2023-7028 - GitLab Production Password Reset Multiple Emails
- GitHub Artifact Download from Cross-Fork Workflow
- GitHub Branch Protection Disabled
- GitHub Branch Protection Policy Override
- GitHub Commits Skipping Workflows
- GitHub Cross-Fork Workflow Run
- GitHub Malicious Comment/Review Content
- GitHub Malicious Commit Content
- GitHub Malicious Issue/Pages Content
- GitHub Malicious Pull Request Content
- GitHub pull_request_target Workflow on Self-Hosted Runner
- GitHub pull_request_target Workflow Usage
- GitHub pull_request_target Workflow with Checkout Action
- GitHub Repository Collaborator Change
- GitHub Sha1-Hulud Malicious Repository Created
- GitHub Supply Chain - Software Installation Tool User Agents
- GitHub Team Modified
- GitHub User Added or Removed from Org
- GitHub Workflow Contains Checkout Action
- GitHub Workflow Dispatched by GitHub Actions Bot
- GitHub Workflow Downloading Artifacts
- GitHub Workflow Permissions Modified
- GitHub Workflow Using Self-Hosted Runner