Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
Supply chain compromise can take place at any stage of the supply chain including:
While supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil 2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired victim set (Citation: Symantec Elderwood Sept 2012) or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
---|---|---|---|---|
CA-2 | Control Assessments | Protects | T1195 | Supply Chain Compromise |
CA-7 | Continuous Monitoring | Protects | T1195 | Supply Chain Compromise |
CM-11 | User-installed Software | Protects | T1195 | Supply Chain Compromise |
CM-7 | Least Functionality | Protects | T1195 | Supply Chain Compromise |
RA-10 | Threat Hunting | Protects | T1195 | Supply Chain Compromise |
RA-5 | Vulnerability Monitoring and Scanning | Protects | T1195 | Supply Chain Compromise |
SA-22 | Unsupported System Components | Protects | T1195 | Supply Chain Compromise |
SI-2 | Flaw Remediation | Protects | T1195 | Supply Chain Compromise |
action.hacking.vector.Partner | Partner connection or credential | related-to | T1195 | Supply Chain Compromise |
action.malware.vector.Software update | Included in automated software update | related-to | T1195 | Supply Chain Compromise |
Technique ID | Technique Name | Number of Mappings |
---|---|---|
T1195.003 | Compromise Hardware Supply Chain | 12 |
T1195.001 | Compromise Software Dependencies and Development Tools | 9 |
T1195.002 | Compromise Software Supply Chain | 9 |