tfMITRE ATT&CK sub-technique

Compromise Hardware Supply Chain T1195.003

sub-technique of T1195 Supply Chain Compromise

Tactic: Initial Access
Platforms: Linux, macOS, Windows
Version: 1.1
Created: 11 March 2020
Last modified: 24 October 2025

Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1195.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Compromise Hardware Supply Chain detection strategy DET0368

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks

Enterprise

3 platforms

AN1035 · Windows

Detects tampered hardware or firmware via anomalous host status telemetry. Behavioral chain: (1) Pre-OS or firmware components exhibit unexpected version changes, signature failures, or modified boot paths; (2) System management/firmware tools log hardware inventory drift; (3) Sensor health telemetry or boot attestation events fail baseline checks; (4) Follow-on process execution from altered firmware or unknown drivers after boot.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Host StatusDC0018	WinEventLog:Security	EventCode=1166, 7045
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File MetadataDC0059	WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	Code integrity violations in boot-start drivers or firmware
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BaselineFirmwareVersion	Expected firmware/BIOS version for each hardware model.
BaselineDriverList	Approved boot-start drivers.
IntegrityCheckInterval	Frequency of integrity checks (e.g., daily, weekly).

AN1036 · Linux

Monitors for hardware or firmware tampering by correlating system boot logs, hardware inventory changes, and secure boot/firmware verification failures. Behavioral chain: (1) UEFI/BIOS version drift; (2) secure boot disabled or signature verification errors; (3) unexpected modules or hardware devices enumerated at boot; (4) new device firmware images loaded from non-approved sources.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	auditd:SYSCALL	firmware_update, kexec_load
File MetadataDC0059	fwupd:logs	Firmware updates applied or failed

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedFirmwareHashes	List of SHA256/SHA512 firmware hashes allowed.
AllowedDeviceIDs	Known hardware component IDs per host baseline.

AN1037 · macOS

Detects tampered Mac hardware/firmware by analyzing unified logs, EndpointSecurity events, and Apple Mobile File Integrity (AMFI) checks. Behavioral chain: (1) Boot process reports firmware signature mismatch; (2) Secure Boot policy altered; (3) new EFI drivers or hardware devices appear in inventory; (4) system extension loads from unapproved developer IDs post-boot.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	EFI firmware integrity check failed
File MetadataDC0059	macos:endpointsecurity	es_event_authentication

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedTeamIDs	Developer Team IDs approved for kext/system extension loads.
FirmwareVersionBaseline	Expected EFI/firmware version for Mac model.

Compromise Hardware Supply Chain detections T1195.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs