1. Home
  2. ATT&CK Techniques
  3. T1195 Supply Chain Compromise

T1195 Supply Chain Compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Supply chain compromise can take place at any stage of the supply chain including:

  • Manipulation of development tools
  • Manipulation of a development environment
  • Manipulation of source code repositories (public or private)
  • Manipulation of source code in open-source dependencies
  • Manipulation of software update/distribution mechanisms
  • Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware)
  • Replacement of legitimate software with modified versions
  • Sales of modified/counterfeit products to legitimate distributors
  • Shipment interdiction

While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.PS-06.01 Secure SDLC process Mitigates T1195 Supply Chain Compromise
Comments
This diagnostic statement provides for the use of secure development processes and procedures. This includes being cautious when selecting third-party libraries to integrate into applications.
References
    DE.CM-09.01 Software and data integrity checking Mitigates T1195 Supply Chain Compromise
    Comments
    This diagnostic statement protects against Supply Chain Compromise through the use of verifying integrity of software/firmware, loading software that is trusted, ensuring privileged process integrity and checking software signatures.
    References
      ID.RA-01.03 Vulnerability management Mitigates T1195 Supply Chain Compromise
      Comments
      This diagnostic statement provides protection from vulnerabilities in exposed applications from across the organization through the use of tools that scan for and review vulnerabilities along with patch management and remediation of those vulnerabilities. Scanning and addressing vulnerabilities in software dependencies can help reduce the attack surface for the organization and protect against adversaries looking for ways to access its systems.
      References
        PR.PS-02.01 Patch identification and application Mitigates T1195 Supply Chain Compromise
        Comments
        This diagnostic statement is related to the implementation of a patch management program. Applying patches and upgrades for products and systems provided by vendors mitigates the risk of adversaries exploiting known vulnerabilities. A patch management process can help prevent supply chain compromise through checking unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
        References
          PR.PS-01.03 Configuration deviation Mitigates T1195 Supply Chain Compromise
          Comments
          This diagnostic statement provides protection from Supply Chain Compromise through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Ensuring software management security standards can help protect against adversaries attempting to compromise the supply chain.
          References
            PR.PS-06.06 Vulnerability remediation Mitigates T1195 Supply Chain Compromise
            Comments
            This diagnostic statement provides for identifying and remediating vulnerabilities as part of the SDLC. Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools can mitigate Supply Chain Compromise.
            References
              EX.DD-04.01 Third-party systems and software evaluation Mitigates T1195 Supply Chain Compromise
              Comments
              This diagnostic statement describes the organization's formal process for evaluating externally-sourced applications, software, and firmware by assessing compatibility, security, integrity, and authenticity before deployment and after major changes. For example, requiring software from external vendors to be signed with valid certificates before deployment to aid in mitigating software supply chain attacks.
              References
                EX.MM-01.01 Third-party monitoring and management resources Mitigates T1195 Supply Chain Compromise
                Comments
                This diagnostic statement protects against Supply Chain Compromise through the implementation of procedures for management of third party products.
                References
                  PR.AA-01.01 Identity and credential management Mitigates T1195 Supply Chain Compromise
                  Comments
                  This diagnostic statement protects against Supply Chain Compromise through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                  References
                    PR.PS-06.07 Development and operational process alignment Mitigates T1195 Supply Chain Compromise
                    Comments
                    This diagnostic statement protects against Supply Chain Compromise through the use of DevSecOps, secure development lifecycle, and application developer guidance. Exploitable weaknesses can be mitigated through secure code, reduced vulnerabilities, and secure design principles.
                    References

                      NIST 800-53 Mappings

                      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                      CA-07 Continuous Monitoring mitigates T1195 Supply Chain Compromise
                      CM-06 Configuration Settings mitigates T1195 Supply Chain Compromise
                      CM-05 Access Restrictions for Change mitigates T1195 Supply Chain Compromise
                      CM-08 System Component Inventory mitigates T1195 Supply Chain Compromise
                      CA-02 Control Assessments mitigates T1195 Supply Chain Compromise
                      RA-10 Threat Hunting mitigates T1195 Supply Chain Compromise
                      SA-22 Unsupported System Components mitigates T1195 Supply Chain Compromise
                      CM-11 User-installed Software mitigates T1195 Supply Chain Compromise
                      SR-11 Component Authenticity mitigates T1195 Supply Chain Compromise
                      SR-04 Provenance mitigates T1195 Supply Chain Compromise
                      SR-05 Acquisition Strategies, Tools, and Methods mitigates T1195 Supply Chain Compromise
                      SI-02 Flaw Remediation mitigates T1195 Supply Chain Compromise
                      RA-05 Vulnerability Monitoring and Scanning mitigates T1195 Supply Chain Compromise
                      SI-03 Malicious Code Protection mitigates T1195 Supply Chain Compromise
                      SI-07 Software, Firmware, and Information Integrity mitigates T1195 Supply Chain Compromise
                      CM-02 Baseline Configuration mitigates T1195 Supply Chain Compromise
                      CM-07 Least Functionality mitigates T1195 Supply Chain Compromise
                      SI-04 System Monitoring mitigates T1195 Supply Chain Compromise
                      AC-02 Account Management mitigates T1195 Supply Chain Compromise
                      AC-03 Access Enforcement mitigates T1195 Supply Chain Compromise
                      AC-06 Least Privilege mitigates T1195 Supply Chain Compromise
                      CM-03 Configuration Change Control mitigates T1195 Supply Chain Compromise

                      VERIS Mappings

                      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                      action.hacking.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
                      action.malware.vector.Partner Partner connection or credential. (Indicates supply chain breach.) related-to T1195 Supply Chain Compromise
                      action.malware.vector.Software update Included in automated software update related-to T1195 Supply Chain Compromise

                      Azure Mappings

                      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                      azure_update_manager Azure Update Manager technique_scores T1195 Supply Chain Compromise
                      Comments
                      This control provides coverage of some aspects of software supply chain compromise since it enables automated updates of software and rapid configuration change management.
                      References
                      1. https://learn.microsoft.com/en-us/azure/update-manager/workflow-update-manager

                      GCP Mappings

                      Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                      assured_oss Assured Open Source Software technique_scores T1195 Supply Chain Compromise
                      Comments
                      Assured OSS provides Google OSS packages built with security features to help improve the security of a software supply chain, including vulnerability testing, signed provenance, and secured distribution.
                      References
                      1. https://cloud.google.com/security/products/assured-open-source-software
                      mandiant_digital_threatmon Mandiant Digital Threat Monitoring technique_scores T1195 Supply Chain Compromise
                      Comments
                      Mandiant Digital Threat Monitoring continually monitors for compromised credentials and data leaks on both the open and dark web. This control may protect against credential abuse by alerting on leaked credentials. Since this control must depend on accessible sources for dumps, it does not protect against credentials that have been collected for a campaign but never posted, so the score is partial.
                      References
                      1. ['https://cloud.google.com/security/products/digital-threat-monitoring']
                      google_secops Google Security Operations technique_scores T1195 Supply Chain Compromise
                      Comments
                      Google Security Ops is able to trigger alerts based on unusual file write events by 3rd party software, specifically SolarWinds executable. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/file_event/unusual_solarwinds_file_creation__via_filewrite.yaral https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/suspicious/unusual_location_svchost_write.yaral
                      References
                      1. ['https://cloud.google.com/security/products/security-operations'
                      2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
                      3. 'https://github.com/chronicle/detection-rules']

                      ATT&CK Subtechniques

                      Technique ID Technique Name Number of Mappings
                      T1195.001 Compromise Software Dependencies and Development Tools 29
                      T1195.003 Compromise Hardware Supply Chain 16
                      T1195.002 Compromise Software Supply Chain 23