Supply Chain Compromise T1195
Tactic: Initial Access
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Events covered
18 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
| Sysmon | Event ID 23 | FileDelete (File Delete archived) |
| Sysmon | Event ID 26 | FileDeleteDetected (File Delete logged) |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5156 | The Windows Filtering Platform has permitted a connection. |
| Defender-DeviceFileEvents | any | File activity (any) |
| Defender-DeviceNetworkEvents | ConnectionSuccess | Connection succeeded |
| ESF | exec | Process Execution (Notify) |
| ESF | create | File or Directory Create (NOTIFY) |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
Patterns shared across the 99 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (78 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (1534 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (83 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 17 rules
- Axios NPM Compromise File Creation Indicators - Linux
- Axios NPM Compromise File Creation Indicators - MacOS
- Axios NPM Compromise File Creation Indicators - Windows
- Axios NPM Compromise Indicators - Linux
- Axios NPM Compromise Indicators - macOS
- Axios NPM Compromise Indicators - Windows
- LiteLLM / TeamPCP Supply Chain Attack Indicators
- Notepad++ Updater DNS Query to Uncommon Domains
- Octopus Scanner Malware
- Outdated Dependency Or Vulnerability Alert Disabled
- Shai-Hulud 2.0 Malicious NPM Package Installation
- Shai-Hulud 2.0 Malicious NPM Package Installation - Linux
- Shai-Hulud Malicious Bun Execution
- Shai-Hulud Malicious Bun Execution - Linux
- Suspicious Child Process of Notepad++ Updater - GUP.Exe
- TeamPCP LiteLLM Supply Chain Attack Persistence Indicators
- Uncommon File Created by Notepad++ Updater Gup.EXE
Elastic 20 rules
- Command Execution via SolarWinds Process
- Deprecated - SUNBURST Command and Control Activity
- DPKG Package Installed by Unusual Parent Process
- Elastic Defend Alert from GenAI Utility or Descendant
- Elastic Defend Alert from Package Manager Install Ancestry
- Execution via GitHub Actions Runner
- GitHub Actions Unusual Bot Push to Repository
- GitHub Actions Workflow Modification Blocked
- Github Activity on a Private Repository from an Unusual IP
- Network Connection to OAST Domain via Script Interpreter
- New GitHub Self Hosted Action Runner
- Node.js Pre or Post-Install Script Execution
- Ollama DNS Query to Untrusted Domain
- Remote GitHub Actions Runner Registration
- RPM Package Installed by Unusual Parent Process
- SolarWinds Process Disabling Services via Registry
- Suspicious Execution from VS Code Extension
- Suspicious SolarWinds Child Process
- Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners
- Unusual DPKG Execution
Splunk 27 rules
- 3CX Supply Chain Attack Network Indicators
- 3CXDesktopApp.exe Execution (EDR)
- 3CXDesktopApp.exe Execution (Sysmon)
- 3CXDesktopApp.exe Execution (Windows Event Log)
- GitHub Enterprise Delete Branch Ruleset
- GitHub Enterprise Disable 2FA Requirement
- GitHub Enterprise Disable Audit Log Event Stream
- GitHub Enterprise Disable Classic Branch Protection Rule
- GitHub Enterprise Disable Dependabot
- GitHub Enterprise Disable IP Allow List
- GitHub Enterprise Modify Audit Log Event Stream
- GitHub Enterprise Pause Audit Log Event Stream
- GitHub Enterprise Register Self Hosted Runner
- GitHub Enterprise Remove Organization
- GitHub Enterprise Repository Archived
- GitHub Enterprise Repository Deleted
- GitHub Organizations Delete Branch Ruleset
- GitHub Organizations Disable 2FA Requirement
- GitHub Organizations Disable Classic Branch Protection Rule
- GitHub Organizations Disable Dependabot
- GitHub Organizations Repository Archived
- GitHub Organizations Repository Deleted
- GitHub Workflow File Creation or Modification
- Hunting 3CXDesktopApp Software
- Shai-Hulud 2 Exfiltration Artifact Files
- Shai-Hulud Workflow File Creation or Modification
- Windows Vulnerable 3CX Software
Kusto 8 rules
- BTP - Cloud Integration package import or transport
- Google DNS - Malicous Python packages
- McAfee ePO - Multiple threats on same host
- McAfee ePO - Threat was not blocked
- Solorigate Defender Detections
- SUNBURST and SUPERNOVA backdoor hashes
- SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events)
- SUNBURST network beacons
Panther 27 rules
- A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094
- Action Performed by Netskope Personnel
- AWS EC2 Vulnerable XZ Image Launched
- CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails
- CVE-2023-7028 - GitLab Production Password Reset Multiple Emails
- GitHub Artifact Download from Cross-Fork Workflow
- GitHub Branch Protection Disabled
- GitHub Branch Protection Policy Override
- GitHub Commits Skipping Workflows
- GitHub Cross-Fork Workflow Run
- GitHub Malicious Comment/Review Content
- GitHub Malicious Commit Content
- GitHub Malicious Issue/Pages Content
- GitHub Malicious Pull Request Content
- GitHub pull_request_target Workflow on Self-Hosted Runner
- GitHub pull_request_target Workflow Usage
- GitHub pull_request_target Workflow with Checkout Action
- GitHub Repository Collaborator Change
- GitHub Sha1-Hulud Malicious Repository Created
- GitHub Supply Chain - Software Installation Tool User Agents
- GitHub Team Modified
- GitHub User Added or Removed from Org
- GitHub Workflow Contains Checkout Action
- GitHub Workflow Dispatched by GitHub Actions Bot
- GitHub Workflow Downloading Artifacts
- GitHub Workflow Permissions Modified
- GitHub Workflow Using Self-Hosted Runner