Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.1
Has leveraged compromised organizations to conduct supply chain attacks on government entities.1
Staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.1
All 3 groups for this technique
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1480 · Windows
1) New or updated software is delivered/installed from atypical sources or with signature/hash mismatches; 2) installer/updater writes binaries to unexpected paths or replaces existing signed files; 3) first run causes unsigned/abnormally signed modules to load or child processes to execute, optionally followed by network egress to new destinations.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog: | EventCode= |
| Process CreationDC0032 | WinEventLog: | EventCode= |
| File CreationDC0039 | WinEventLog: | EventCode= |
| File MetadataDC0059 | WinEventLog: | CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/ |
| Network Traffic FlowDC0078 | NSM: | First-time egress from host after new install to unknown update endpoints |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation window between install events and first-run activity (default 2h; adjust for staged rollouts). |
| TrustedPublishers | Publisher/Signer allow-list to suppress expected updates. |
| TrustedUpdateHosts | Known update CDNs/APIs (e.g., download.microsoft.com) to reduce egress false positives. |
| RiskScoreThreshold | Score cut-off for alerting when combining path, signer, and reputation features. |
AN1481 · Linux
1) Package manager or curl/wget installs/upgrades from non-approved repos or unsigned packages; 2) new ELF written into PATH directories or replacement of existing binaries/libraries; 3) first run leads to unexpected child processes or outbound connections.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | auditd: | open, rename |
| Process CreationDC0032 | auditd: | execve, unlink |
| File MetadataDC0059 | journald: | dpkg/ |
| Network Traffic FlowDC0078 | NSM: | First-time egress to unknown registries/ |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApprovedRepos | Allow-listed APT/YUM repo URLs and GPG key fingerprints. |
| PathScope | Directories to watch for new ELF writes (e.g., /usr/bin, /usr/local/bin, /lib*/, /opt/*/bin). |
| MinBinarySize | Ignore tiny helper files; default >16KB. |
| TimeWindow | Install→first-run correlation window (default 2h). |
AN1482 · macOS
1) pkg/notarization installs from atypical sources or with Gatekeeper/AMFI warnings; 2) new Mach-O written into /Applications or ~/Library paths or substitution of signed components; 3) first run from installer spawns unsigned children or exfil.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos: | launchd, processes |
| File MetadataDC0059 | macos: | installer or system_installd 'PackageKit: |
| File ModificationDC0061 | macos: | write, rename |
| Network Traffic FlowDC0078 | NSM: | New egress from app just installed to unknown update endpoints |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedTeamIDs | Apple Developer Team IDs permitted in your fleet. |
| TrustedDMGs | Known DMG/Pkg sources and hashes. |
| TimeWindow | Install→first-run correlation window (default 2h). |
| RiskScoreThreshold | Adjust alert sensitivity based on org tolerance. |
Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build.
Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.
Where possible, consider requiring developers to pull from internal repositories containing verified and approved packages rather than from external ones.
A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.
Implement robust user account management practices to limit permissions associated with software execution. Ensure that software runs with the lowest necessary privileges, avoiding the use of root or administrator accounts when possible. By restricting permissions, you can minimize the risk of propagation and unauthorized actions in the event of a supply chain compromise, reducing the attack surface for adversaries to exploit within compromised systems.
Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Octopus Scanner Malware Open Source Supply Chain | windows | command_prompt | — | 1 | Yes | ||||||||||
This test simulates an adversary Octopus drop the RAT dropper ExplorerSync.db octopus-scanner-malware-open-source-supply-chain the-supreme-backdoor-factory Inputs
Attack Commandsrun with command_promptcopy %temp%\ExplorerSync.db %temp%\..\Microsoft\ExplorerSync.db schtasks /create /tn ExplorerSync /tr "javaw -jar %temp%\..\Microsoft\ExplorerSync.db" /sc MINUTE /f Cleanup Commands schtasks /delete /tn ExplorerSync /F 2>null del %temp%\..\Microsoft\ExplorerSync.db 2>null del %temp%\ExplorerSync.db 2>null Dependenciesrun with powershellDescription ExplorerSync.db must exist on disk at specified location (#{rat_payload}) Check Prereq Commands if (Test-Path #{rat_payload}) {exit 0} else {exit 1}
Get Prereq Commands Out-File -FilePath "#{rat_payload}"
GUID82a9f001-94c5-495e-9ed5-f530dbded5e2 | ||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
21 rules are mapped to this technique.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects when branch rules are deleted in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 6169ea23-3719-439f-957a-0ea5174b70e2 | |||
Splunk | The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 5a773226-ebd7-480c-a819-fccacfeddcd9 | |||
Splunk | The following analytic detects when a user disables audit log event streaming in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 7bc111cc-7f1b-4be7-99fa-50cf8d2e7564 | |||
Splunk | The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 372176ba-450c-4abd-9b86-419bb44c1b76 | |||
Splunk | The following analytic detects when a user disables Dependabot security features within a GitHub repository. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 787dd1c1-eb3a-4a31-8e8c-2ad24b214bc8 | |||
Splunk | The following analytic identifies when an IP allow list is disabled in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | afed020e-edcd-4913-a675-cebedf81d4fb | |||
Splunk | The following analytic detects when a user modifies or disables audit log event streaming in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 99abf2e1-863c-4ec6-82f8-714391590a4c | |||
Splunk | The following analytic detects when a user pauses audit log event streaming in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 21083dcb-276d-4ef9-8f7e-2113ca5e8094 | |||
Splunk | The following analytic identifies when a self-hosted runner is created in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | b27685a2-8826-4123-ab78-2d9d0d419ed0 | |||
Splunk | The following analytic detects when a user removes an organization from GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 94cb89aa-aec1-4585-91b1-affcdacf357e | |||
Splunk | The following analytic detects when a repository is archived in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 8367cb99-bae1-4748-ae3b-0927bb381424 | |||
Splunk | The following analytic detects when a user deletes a repository in GitHub Enterprise. (...) | Anomaly | stable | - | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | f709e736-3e6c-492f-b865-bc7696cc24a7 | |||
Splunk | The following analytic detects when branch rulesets are deleted in GitHub Organizations. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 8e454f64-4bd6-45e6-8a94-1b482593d721 | |||
Splunk | The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Organizations. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 3ed0d6ba-4791-4fa8-a1ef-403e438c7033 | |||
Splunk | The following analytic detects when classic branch protection rules are disabled in GitHub Organizations. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 33cffee0-41ee-402e-a238-d37825f2d788 | |||
Splunk | The following analytic detects when a user disables Dependabot security features within a GitHub repository. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 69078d8c-0de6-45de-bb00-14e78e042fd6 | |||
Splunk | The following analytic detects when a repository is archived in GitHub Organizations. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 4f568a0e-896f-4d94-a2f7-fa6d82ab1f77 | |||
Splunk | The following analytic identifies when a repository is deleted within a GitHub organization. (...) | Anomaly | stable | cloud_audit | - | GitHub | - | medium | Patrick Bareiss, Splunk | 2025-01-15 | 2026-05-13 | 9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71 | |||
Splunk | The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization's Linux or Windows endpoints. (...) | Hunting | stable | file_event | linux · windows | Sysmon | - | medium | Michael Haag, Splunk | 2025-11-25 | 2026-05-13 | 2a9f3a2e-2c07-4c5f-9e42-8f8f0b6b6a12 | |||
Detects Octopus Scanner Malware. | Generic | test | file_event | windows | Sysmon | - | high | NVISO | 2020-06-09 | 2021-11-27 | 805c55d9-31e6-4846-9878-c34c75054fe9 | ||||
Splunk | Detects creation or deletion of malicious GitHub Actions workflow files associated with
Shai-Hulud w (...) | Generic | stable | file_event | linux · windows | Sysmon | - | medium | Michael Haag, Splunk | 2025-11-25 | 2026-05-13 | 6b4a0a7f-10d1-4d72-9c4c-5c6a3d9f9d6a |