MITRE ATT&CKsub-technique

T1195.002 Compromise Software Supply Chain

Published 2020-03-11 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Initial Access
Platforms
Linux, Windows, macOS
Version
1.1
Created
2020-03-11

Description

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1195 Supply Chain Compromise technique

Tactic · MITRE ATT&CK (1)

  • TA0001 Initial Access tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1051 Update Software mitigation
  • M1016 Vulnerability Scanning mitigation

Referenced by MITRE ATT&CK · uses (14)

  • C0057 3CX Supply Chain Attack campaign
  • G1036 Moonstone Sleet group
  • G1034 Daggerfly group
  • C0024 SolarWinds Compromise campaign
  • S0562 SUNSPOT software (malware)
  • G0115 GOLD SOUTHFIELD group
  • S0493 GoldenSpy software (malware)
  • G0096 APT41 group
  • G0080 Cobalt Group group
  • S0222 CCBkdr software (malware)
  • G0027 Threat Group-3390 group
  • G0034 Sandworm Team group
  • G0035 Dragonfly group
  • G0046 FIN7 group

Referenced by CAPEC · att&ck technique (8)

  • CAPEC-186 Malicious Software Update attack pattern
  • CAPEC-442 Infected Software attack pattern
  • CAPEC-443 Malicious Logic Inserted Into Product by Authorized Developer attack pattern
  • CAPEC-523 Malicious Software Implanted attack pattern
  • CAPEC-669 Alteration of a Software Update attack pattern
  • CAPEC-673 Developer Signing Maliciously Altered Software attack pattern
  • CAPEC-678 System Build Data Maliciously Altered attack pattern
  • CAPEC-691 Spoof Open-Source Software Metadata attack pattern

Referenced by Compliance · mitigates (14)

  • CIS-16.12 Implement Code-Level Security Checks CIS Safeguard v8.1
  • CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components CIS Safeguard v8.1
  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • NIST-CA-2 Control Assessments NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-RA-10 Threat Hunting NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-22 Unsupported System Components NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

References