Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.1
Has leveraged compromised organizations to conduct supply chain attacks on government entities.1
Staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.1
All 3 groups for this technique
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1480 · Windows
1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File MetadataDC0059 | WinEventLog:Microsoft-Windows-CodeIntegrity/Operational | CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries |
| Network Traffic FlowDC0078 | NSM:Flow | First-time egress from host after new install to unknown update endpoints |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between install events and first-run activity (default 2h; adjust for staged rollouts). |
| TrustedPublishers | Publisher/Signer allow-list to suppress expected updates. |
| TrustedUpdateHosts | Known update CDNs/APIs (e.g., download.microsoft.com) to reduce egress false positives. |
| RiskScoreThreshold | Score cut-off for alerting when combining path, signer, and reputation features. |
AN1481 · Linux
1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | auditd:SYSCALL | open, rename |
| Process CreationDC0032 | auditd:SYSCALL | execve, unlink |
| File MetadataDC0059 | journald:package | dpkg/apt install, remove, upgrade events |
| Network Traffic FlowDC0078 | NSM:Flow | First-time egress to unknown registries/mirrors immediately after install |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApprovedRepos | Allow-listed APT/YUM repo URLs and GPG key fingerprints. |
| PathScope | Directories to watch for new ELF writes (e.g., /usr/bin, /usr/local/bin, /lib*/, /opt/*/bin). |
| MinBinarySize | Ignore tiny helper files; default >16KB. |
| TimeWindow | Install→first-run correlation window (default 2h). |
AN1482 · macOS
1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | launchd, processes |
| File MetadataDC0059 | macos:unifiedlog | installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer |
| File ModificationDC0061 | macos:endpointsecurity | write, rename |
| Network Traffic FlowDC0078 | NSM:Flow | New egress from app just installed to unknown update endpoints |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedTeamIDs | Apple Developer Team IDs permitted in your fleet. |
| TrustedDMGs | Known DMG/Pkg sources and hashes. |
| TimeWindow | Install→first-run correlation window (default 2h). |
| RiskScoreThreshold | Adjust alert sensitivity based on org tolerance. |
Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build.
Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.
Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
Implement robust user account management practices to limit permissions associated with software execution. Ensure that software runs with the lowest necessary privileges, avoiding the use of root or administrator accounts when possible. By restricting permissions, you can minimize the risk of propagation and unauthorized actions in the event of a supply chain compromise, reducing the attack surface for adversaries to exploit within compromised systems.
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Octopus Scanner Malware Open Source Supply Chain | windows | cmd | — | 1 | Yes | ||||||||||
This test simulates an adversary Octopus drop the RAT dropper ExplorerSync.db octopus-scanner-malware-open-source-supply-chain the-supreme-backdoor-factory Input arguments
Attack command copy %temp%\ExplorerSync.db %temp%\..\Microsoft\ExplorerSync.db schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f Cleanup command schtasks /delete /tn ExplorerSync /F 2>null del %temp%\..\Microsoft\ExplorerSync.db 2>null del %temp%\ExplorerSync.db 2>null Prerequisite ExplorerSync.db must exist on disk at specified location (#{rat_payload}) Check if (Test-Path #{rat_payload}) {exit 0} else {exit 1}
Satisfy Out-File -FilePath "#{rat_payload}"
GUID22af26a1-de8e-4dfb-9c7f-a6b8de7c6d93 | ||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
21 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|