T1195.003 — Compromise Hardware Supply Chain

Tactic: Initial Access · Platforms: Linux, macOS, Windows

Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the…

Sub-technique of Supply Chain Compromise (T1195).

Sigma detection rules (3)

T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain

title: "T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain"
id: f9487660-c355-4345-b242-16353edd3eb3
description: 'Detects unsigned or unverified kernel driver loads that may indicate a hardware- or firmware-level backdoor introduced via a compromised hardware supply chain; genuine pre-delivery hardware/firmware tampering is not directly observable via Windows Sysmon telemetry, so this rule flags the closest defensible proxy signal. (Data Component: Driver Load; baseline tier: windows-eventid.) Tune using: BaselineFirmwareVersion, BaselineDriverList, IntegrityCheckInterval.'
references:
  - https://attack.mitre.org/techniques/T1195/003
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.003

logsource:
  category: driver_load
  product: windows

detection:
  selection:
    EventID: '6'
    Signed: 'false'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate but unsigned in-house or vendor-supplied drivers (common on some OEM hardware) — maintain BaselineDriverList to allowlist known-good unsigned drivers.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account.

level: medium

T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain

title: "T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain"
id: 32ce9b7f-ab95-4ef6-8036-53f7adcf97c6
description: 'Hardware/firmware supply-chain implants are physically inserted into components before or during manufacturing/shipping and operate below the OS and its audit subsystem entirely - no Linux auditd (or any OS-level) telemetry can observe the implantation itself. The prior CONFIG_CHANGE/add_rule proxy only captured someone adding an audit rule, which is unrelated to hardware tampering. This rule is retargeted to the closest defensible Linux-observable proxy: execution of firmware flashing/inspection utilities (flashrom, fwupdmgr, dmidecode), which may indicate on-host interaction with device firmware post-deployment. This does NOT detect a hardware supply-chain compromise itself - only firmware-tooling activity worth reviewing. Genuine detection requires boot-integrity/TPM measured-boot attestation or hardware provenance/inventory verification outside auditds scope. Tune using: ApprovedFirmwareHashes, AllowedDeviceIDs.'
references:
  - https://attack.mitre.org/techniques/T1195/003
author: Shahrukh Khan
date: 2026-01-04
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.003

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/flashrom'
      - '/fwupdmgr'
      - '/fwupdate'
      - '/dmidecode'

  condition: selection

falsepositives:
  - Legitimate firmware inventory checks or update activity performed by system administrators, hardware vendors, or automated patch-management tooling.

level: low

T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain

title: "T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain"
id: 2e4d2d6a-818e-4b50-b382-d667463a1cff
description: 'Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedTeamIDs, FirmwareVersionBaseline.'
references:
  - https://attack.mitre.org/techniques/T1195/003
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.initial-access
  - attack.t1195.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/system_profiler'
    CommandLine|contains: 'SPiBridgeDataType'

  condition: selection

falsepositives:
  - Routine firmware and hardware inventory checks by IT asset management tools; actual hardware supply-chain tampering is not observable from unified log at all, only these inventory queries.

level: low

Related sub-techniques

Explore