TA0001 · INITIAL ACCESS
Supply Chain Compromise
Trojanised software updates, poisoned dependencies, or compromised managed service providers.
Detect it with
Baseline what your update processes normally do, then alert when a signed updater deviates — new child processes, new destinations.
Why it matters on shift
Supply Chain Compromise is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1195.001
Compromise Software Dependencies and Development Tools
Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly.
- T1195.002
Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
- T1195.003
Compromise Hardware Supply Chain
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.
Kill-chain context