Compromise Software Supply Chain (MITRE ATT&CK T1195.002) is a sub-technique of supply chain compromise. The adversary manipulates application software before the final consumer receives it, for the purpose of data or system compromise. MITRE files it under Initial Access and lists Linux, Windows and macOS.
How attackers use it
MITRE says this can happen in several ways: manipulating the application source code, manipulating the update or distribution mechanism, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set, or broad, with further action taken only against specific victims.
The MITRE page describes a case where a build environment for Windows and macOS was modified to distribute software to a vendor's customer base, a signed release of a popular utility that carried a backdoor and was served from the vendor's own distribution site, and an attacker with access to production environments who injected code into legitimate signed files.
The lesson is that a valid signature and a trusted download site do not prove the software is clean.
How to detect it
MITRE's detection strategy follows installer or updater write, then first run, then egress or signature anomaly.
- Windows. An updater or installer (msiexec, setup, update.exe, a vendor service) writes or replaces binaries. On first run it spawns scripts, shells or unsigned DLLs and contacts update hosts that are not approved. Correlate the installer process, file changes in program paths, first-run children and module or signature anomalies, and outbound connections within a short window.
- Linux. A package or update (deb, rpm, tarball, AppImage or vendor updater) writes or overwrites files in /usr/local/bin, /usr/bin, /opt or ~/.local. First run launches shells, curl or wget and connects to unapproved hosts.
- macOS. A tampered app, package or update installed through an installer, softwareupdated, Homebrew or a vendor updater puts new Mach-O files or bundle content in /Applications, /Library, /usr/local or /opt/homebrew. First run spawns sh, zsh, osascript or curl. AMFI and Gatekeeper may log signature or notarization problems.
How to reduce the risk
MITRE's mitigations:
- Patch management that also checks for unused, unmaintained or previously vulnerable software and unnecessary components.
- Continuous vulnerability monitoring with automatic and manual code review tools.
For build and release pipelines, signed and verifiable build records help you check that a release came from the build you expect.
Try it yourself
This demo shows how attestation and provenance records let you check where an artifact came from.
Click through it at your own pace, or open it full screen.
Quick check
Does a valid signature prove an update is safe?
No. MITRE describes cases where malicious code was added to legitimately signed releases, so first-run behavior and network activity still matter.
