THREATNOIR
Subscribe
MITRE ATT&CK · T1195.002

Compromise Software Supply Chain

MITRE · cited in 12 of our lessons

Explanation

What attackers do. Attackers modify legitimate software, for example by compromising a vendor's build system or update channel, so that customers install a tampered version. This Supply Chain Compromise sub-technique serves Initial Access and can reach many victims at once.

How to defend. Assess the security of key software suppliers, verify signatures and hashes, and stage updates in a test environment before wide deployment where feasible. Restrict network access for software that does not need the internet, which limits a tampered update's ability to call home. Monitor trusted software for new behaviour.

Signs to look for. Look for trusted applications contacting unfamiliar domains after an update, unexpected child processes, and vendor or community advisories about compromised builds. A common gap is excluding trusted vendor software from security monitoring to reduce noise.

Open the technique on MITRE ATT&CK
The official text
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.