Supply Chain Compromise

What is Supply Chain Compromise?

“Supply Chain Compromise is documented as technique T1195 in MITRE ATT&CK® v19.1 under the Initial Access tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Supply Chain Compromise activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor software update processes and compare checksums and digital signatures of installed packages against vendor-provided cryptographic hashes to detect packages that have been tampered with during distribution.

2. 2

   Implement software composition analysis to maintain a comprehensive inventory of third-party libraries and dependencies, enabling rapid identification of compromised components when supply chain incidents are publicly disclosed.

3. 3

   Monitor outbound network connections from developer workstations and build servers for unexpected communications to external infrastructure, which may indicate compromised build tools exfiltrating source code or credentials.

4. 4

   Analyze behavioral baselines of software immediately after updates and compare network activity, process spawning, and file system access patterns against pre-update baselines to detect newly introduced malicious behavior.

5. 5

   Track provenance of software artifacts throughout the build and deployment pipeline using code signing, reproducible builds, and software bill of materials to identify unauthorized modifications introduced at any stage of development.

Example Alerts

These realistic alert examples show what Supply Chain Compromise looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Supply Chain Compromise?

Detection centers on SIEM, XDR telemetry for the initial access phase of the attack. Monitor software update processes and compare checksums and digital signatures of installed packages against vendor-provided cryptographic hashes to detect packages that have been tampered with during distribution. Implement software composition analysis to maintain a comprehensive inventory of third-party libraries and dependencies, enabling rapid identification of compromised components when supply chain incidents are publicly disclosed.

What does a Supply Chain Compromise alert look like?

A representative SIEM detection is "Unexpected Network Beacon Following Software Update" (critical severity): Network monitoring detected workstations initiating HTTPS connections to update-telemetry-cdn.net immediately after installing version 3.14.2 of a monitoring agent. Prior versions never contacted this domain. The domain was registered 45 days ago and resolves to infrastructure not associated with the legitimate software vendor, strongly suggesting a compromised update package.

Which tools detect Supply Chain Compromise, and how can I practice?

Supply Chain Compromise (T1195) is best surfaced with SIEM, XDR telemetry, which exposes the initial access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.