T1195.001 — Compromise Software Dependencies and Development Tools

Tactic: Initial Access · Platforms: Linux, macOS, Windows

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many…

Sub-technique of Supply Chain Compromise (T1195).

Sigma detection rules (3)

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

title: "T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
id: e7cf7549-cf21-43f5-8fa1-76967b04c225
description: 'Supply-chain tamper in dependencies/dev-tools, now including package managers (npm, npx, yarn, pnpm, pip) spawning a shell/interpreter during install/postinstall scripts, alongside the original generic installer pattern. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, ApprovedRegistries, DevHosts, TrustedPublishers.'
references:
  - https://attack.mitre.org/techniques/T1195/001
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_installer:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'

  selection_package_manager:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
      - '\npx.exe'
      - '\yarn.cmd'
      - '\pnpm.cmd'
      - '\pip.exe'
      - '\pip3.exe'
      - '\python.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\node.exe'
      - '\python.exe'
      - '\cscript.exe'
      - '\wscript.exe'

  condition: selection_installer or selection_package_manager

falsepositives:
  - Legitimate installer post-install scripts commonly shell out to PowerShell/cmd, and legitimate npm/pip/yarn postinstall/build hooks routinely spawn interpreters.

level: medium

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

title: "T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
id: d27c0fcf-516b-45f0-b746-a18e603e549e
description: 'Supply-chain tamper in dependencies/dev-tools: flags pip/pip3/npm/gem install invocations only when they reference a non-default package source (direct HTTP(S)/git URL, or an explicit non-default index/registry flag), rather than any install command, since routine dependency installs from the default registry give no signal of tampering. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApprovedRepos, PathScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1195/001
author: Shahrukh Khan
date: 2026-05-27
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_base:
    type: EXECVE
    a0|endswith:
      - '/pip'
      - '/pip3'
      - '/npm'
      - '/gem'
    a1: 'install'
  selection_nondefault_source:
    - a2|contains:
        - 'http://'
        - 'https://'
        - 'git+'
        - '--index-url'
        - '--extra-index-url'
        - '--registry'
    - a3|contains:
        - 'http://'
        - 'https://'
        - 'git+'
        - '--index-url'
        - '--extra-index-url'
        - '--registry'
    - a4|contains:
        - 'http://'
        - 'https://'
        - 'git+'
        - '--index-url'
        - '--extra-index-url'
        - '--registry'

  condition: selection_base and selection_nondefault_source

falsepositives:
  - Internal private registries/mirrors (Artifactory, Nexus, Verdaccio, private PyPI/npm/gem mirrors) legitimately configured via --index-url/--extra-index-url/--registry flags; add the ApprovedRepos allow-list for these known-good internal mirror URLs. Installing directly from an internal git monorepo via git+ URLs is also common in some CI setups.

level: medium

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

title: "T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
id: a7a2b52d-9706-4ecc-8222-1a64f8086fbb
description: 'Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTeamIDs, BrewTapsAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1195/001
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/brew'
    CommandLine|contains: 'tap'

  condition: selection

falsepositives:
  - Developers legitimately add new, non-default Homebrew taps for approved packages.

level: medium

Related sub-techniques

Explore