Compromise Hardware Supply Chain (MITRE ATT&CK T1195.003) is a sub-technique of supply chain compromise. The adversary manipulates hardware components in products before the final consumer receives them. MITRE files it under Initial Access and lists Linux, Windows and macOS.
How attackers use it
By modifying hardware or firmware in the supply chain, an adversary can insert a backdoor into consumer networks. MITRE says it may be difficult to detect and may give the adversary a high degree of control over the system. Hardware backdoors may be inserted into devices such as servers, workstations, network infrastructure or peripherals.
Because the change sits below the operating system, ordinary host tools may not see it. Detection depends on checking the platform itself.
How to detect it
MITRE's detection strategy uses host status and boot integrity checks. The behavioral chain:
- Pre-OS or firmware components show unexpected version changes, signature failures or modified boot paths.
- System management or firmware tools log hardware inventory drift.
- Sensor health telemetry or boot attestation events fail baseline checks.
- Processes run from altered firmware or unknown drivers after boot.
By platform: on Windows and Linux, watch UEFI or BIOS version drift, secure boot disabled or signature verification errors, unexpected modules or devices enumerated at boot, and new device firmware images from non-approved sources. On macOS, look for firmware signature mismatches at boot, a changed Secure Boot policy, new EFI drivers or hardware in inventory, and system extensions loaded from unapproved developer IDs after boot.
The practical base is an inventory. Record firmware versions and hardware lists when a device is received and compare them over time.
How to reduce the risk
MITRE lists one mitigation, boot integrity: use Trusted Platform Module technology and a secure or trusted boot process to protect system integrity, and check the integrity of the existing BIOS or EFI to see whether it is vulnerable to modification.
Read-only checks. On Windows, run this in an elevated PowerShell to see whether Secure Boot is enabled:
Confirm-SecureBootUEFI
On Linux:
mokutil --sb-state
Quick check
Why is this technique hard to see from inside the operating system?
The modification is in hardware or firmware, below the operating system, so host tools may not report it. Boot integrity and inventory checks are the tools that apply.
