TA0001 · INITIAL ACCESS
Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
Detect it with
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.
Why it matters on shift
Compromise Software Supply Chain is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context