T1195.002 — Compromise Software Supply Chain

Tactic: Initial Access · Platforms: Linux, Windows, macOS

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution…

Sub-technique of Supply Chain Compromise (T1195).

Sigma detection rules (3)

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

title: "T1195.002 Supply Chain Compromise: Compromise Software Supply Chain"
id: ffb7d673-e759-495c-a515-c088decb32d5
description: 'Detects unsigned driver load as proxy for tampered installers/updaters dropping malicious kernel components. (Data Component: Driver Load; baseline tier: windows-eventid.) Tune using: TimeWindow, ApprovedUpdateHosts, ApprovedSigners, ProgramPaths.'
references:
  - https://attack.mitre.org/techniques/T1195/002
author: Shahrukh Khan
date: 2026-03-17
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.002

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '6'
    Signed: 'false'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimately unsigned drivers on dev/QA systems.

level: medium

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

title: "T1195.002 Supply Chain Compromise: Compromise Software Supply Chain"
id: d394600f-eac6-43e8-a077-830c1e46f49d
description: 'Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly). (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PathScope, ApprovedRepos, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1195/002
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.002

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/dpkg'
      - '/apt'
      - '/apt-get'
      - '/rpm'
      - '/yum'
    a1|contains:
      - '--force'
      - '--nogpgcheck'

  condition: selection

falsepositives:
  - Disabling GPG verification is occasionally used deliberately in air-gapped/internal-mirror environments without proper signing set up; still a strong red flag on hosts expected to enforce package signature validation.

level: high

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

title: "T1195.002 Supply Chain Compromise: Compromise Software Supply Chain"
id: 562496fe-228d-40d7-817c-298ff1bdd063
description: 'Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTeamIDs, BrewTapsAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1195/002
author: Shahrukh Khan
date: 2026-03-27
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/installer'
    CommandLine|contains: '-pkg'

  condition: selection

falsepositives:
  - Routine software deployment via signed pkg installers matches the same command pattern.

level: medium

Related sub-techniques

Explore