{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","url":"https://attack.mitre.org/techniques/T1195/001","tactics":["initial-access"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0009","stix_id":"x-mitre-detection-strategy--ec870f2d-bba3-43f9-95b8-c2f85678dba4","name":"Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)","url":"https://attack.mitre.org/detectionstrategies/DET0009","analytics":[{"id":"AN0021","stix_id":"x-mitre-analytic--9ec9d296-173f-4e47-8bc4-d20d558e6e18","name":"Analytic 0021","description":"Adversary manipulates dependencies/dev tools used by developers or CI: a package manager (npm/yarn/pnpm, pip/pipenv, nuget/dotnet, chocolatey/winget, maven/gradle) or a compiler/IDE downloads or restores content; files are written under project paths and execution paths (node_modules, packages, .nuget, .gradle, .m2, %AppData%\\npm, %UserProfile%\\.cargo\\bin, temp build dirs). First run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning, or loader DLLs, followed by network egress to non-approved registries/CDNs.","url":"https://attack.mitre.org/detectionstrategies/DET0009#AN0021","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-CodeIntegrity/Operational","channel":"Invalid/Unsigned image when developer tool launches newly installed binaries","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-microsoft-windows-codeintegrity-operational"},{"name":"NSM:Flow","channel":"First-time outbound connections to package registries or unknown hosts immediately after restore/build","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlate file write by package manager to first execution and egress (default 90 minutes)."},{"field":"ApprovedRegistries","description":"Allow-listed registries (e.g., registry.npmjs.org, pypi.org, nuget.org, maven.apache.org, company proxies/CDNs)."},{"field":"DevHosts","description":"Limit analytics to engineering endpoints/CI agents to reduce noise."},{"field":"TrustedPublishers","description":"Code-signing publishers acceptable for dev tools."}],"live":true,"detection_strategies":["DET0009"],"techniques":["T1195.001"]},{"id":"AN0022","stix_id":"x-mitre-analytic--9e95639e-633f-47cf-b343-3ea771c19192","name":"Analytic 0022","description":"Developer or CI invokes package managers/compilers (apt/yum + build-essential, npm/yarn/pnpm, pip/pip3, gem, cargo, go, maven/gradle). These write executable or script files into PATH or project dirs and immediately execute embedded lifecycle hooks (preinstall/postinstall, setup.py, npm scripts) that spawn shells or curl/wget, followed by egress to unfamiliar registries or domains.","url":"https://attack.mitre.org/detectionstrategies/DET0009#AN0022","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"rename, chmod","data_component":"DC0020","data_component_name":"Process Modification","log_source_slug":"auditd-syscall"},{"name":"journald:package","channel":"dpkg/apt or yum/dnf transaction logs (install/update of build tools)","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"journald-package"},{"name":"NSM:Flow","channel":"First-time egress to new registries/CDNs post-install/build","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ApprovedRepos","description":"Allowed APT/YUM repos and GPG keys for build tools."},{"field":"PathScope","description":"Monitor /usr/local/bin, /usr/bin, /opt/*/bin, ~/.local/bin, node_modules/.bin, .venv/bin, .cargo/bin, .gradle, .m2."},{"field":"TimeWindow","description":"Default 90 minutes for write→exec→egress linkage."}],"live":true,"detection_strategies":["DET0009"],"techniques":["T1195.001"]},{"id":"AN0023","stix_id":"x-mitre-analytic--0f186e7f-fe33-45d6-ba1e-02a334cf1cb3","name":"Analytic 0023","description":"Developer tools (Homebrew, pip, npm/yarn, Xcode builds) install or update dependencies; new Mach-O or scripts appear under /usr/local, /opt/homebrew, ~/Library/Application Support, project dirs (node_modules/.bin, venv/bin). First run spawns sh/zsh/osascript/curl and new outbound flows; Gatekeeper/AMFI may flag unsigned components.","url":"https://attack.mitre.org/detectionstrategies/DET0009#AN0023","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"softwareupdated/homebrew/install logs, pkginstalld events","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"exec","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"NSM:Flow","channel":"First-time egress to non-approved registries after dependency install","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"AllowedTeamIDs","description":"Apple Developer Team IDs for approved dev tools (Xcode, JetBrains, etc.)."},{"field":"BrewTapsAllowList","description":"Homebrew taps allowed in your environment."},{"field":"TimeWindow","description":"Default 90 minutes."}],"live":true,"detection_strategies":["DET0009"],"techniques":["T1195.001"]}],"live":true,"version":"1.0","techniques":["T1195.001"]}],"sigma_rules":[{"id":"34e1c7d4-0cd5-419d-9f1b-1dad3f61018d","title":"Outdated Dependency Or Vulnerability Alert Disabled","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"high","date":"2023-01-27","modified":null,"description":"Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.\nThis rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.\n","references":["https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization"],"logsource":{"product":"github","service":"audit"},"tags":["attack.initial-access","attack.t1195.001"],"path":"rules/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml","techniques":["T1195.001"],"cves":[]},{"id":"805c55d9-31e6-4846-9878-c34c75054fe9","title":"Octopus Scanner Malware","author":"NVISO","status":"test","level":"high","date":"2020-06-09","modified":"2021-11-27","description":"Detects Octopus Scanner Malware.","references":["https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1195","attack.t1195.001"],"path":"rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml","techniques":["T1195","T1195.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}