Techniques › T1195.001 › AN0021
AN0021 Analytic 0021
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary manipulates dependencies/dev tools used by developers or CI: a package manager (npm/yarn/pnpm, pip/pipenv, nuget/dotnet, chocolatey/winget, maven/gradle) or a compiler/IDE downloads or restores content; files are written under project paths and execution paths (node_modules, packages, .nuget, .gradle, .m2, %AppData%\npm, %UserProfile%\.cargo\bin, temp build dirs). First run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning, or loader DLLs, followed by network egress to non-approved registries/CDNs.</p>
- Detects
- T1195.001 Compromise Software Dependencies and Development Tools
- Part of
- DET0009 Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Microsoft-Windows-CodeIntegrity/Operational | Invalid/Unsigned image when developer tool launches newly installed binaries | DC0059 File Metadata |
| NSM:Flow | First-time outbound connections to package registries or unknown hosts immediately after restore/build | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlate file write by package manager to first execution and egress (default 90 minutes). |
ApprovedRegistries | Allow-listed registries (e.g., registry.npmjs.org, pypi.org, nuget.org, maven.apache.org, company proxies/CDNs). |
DevHosts | Limit analytics to engineering endpoints/CI agents to reduce noise. |
TrustedPublishers | Code-signing publishers acceptable for dev tools. |