Which SIEM platforms have a T1195 detection rule?

df00tech provides T1195 (Supply Chain Compromise) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Supply Chain Compromise (T1195)?

Detecting Supply Chain Compromise requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1195 detection?

The T1195 detection is rated critical severity with medium confidence.

What are common false positives for T1195?

Common false positives for T1195 include: Legitimate software installers (especially older or enterprise software) that invoke cmd.exe or PowerShell as part of post-install configuration scripts or service registration; Software deployment platforms (SCCM, Intune, PDQ Deploy) that use msiexec.exe or setup.exe as wrappers that legitimately spawn PowerShell for configuration; Electron-based applications (VSCode, Slack, Teams) whose squirrel.exe updater spawns cmd.exe for delta patching operations.

T1195

Supply Chain Compromise

Initial Access Last updated: April 18, 2026

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can occur at any stage — from manipulation of development tools, source code repositories, open-source dependencies, software update/distribution mechanisms, system images, or physical hardware. Because the attack abuses trusted software distribution channels, defenders must focus on post-delivery behavioral indicators: trusted installer processes spawning shells, legitimate software making unexpected network connections, newly installed applications loading unsigned modules, and integrity failures in software binaries. High-profile incidents include SolarWinds Orion (Sunburst backdoor in update packages), CCleaner (backdoor distributed via official update), 3CX (second-order compromise via trojanized Electron app), and NotPetya (distributed via M.E.Doc accounting software update).

What is T1195 Supply Chain Compromise?

Supply Chain Compromise (T1195) maps to the Initial Access tactic — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for Supply Chain Compromise, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Initial Access
Technique: T1195 Supply Chain Compromise
Canonical reference: https://attack.mitre.org/techniques/T1195/

Microsoft Sentinel / Defender

kusto

let TrustedInstallerProcesses = dynamic([
    "msiexec.exe", "setup.exe", "install.exe", "installer.exe",
    "update.exe", "updater.exe", "autoupdate.exe", "squirrel.exe",
    "appinstaller.exe", "packageinstaller.exe", "softwareupdate.exe",
    "uninst.exe", "uninstall.exe", "patchinstaller.exe"
]);
let LOLBins = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
    "wmic.exe", "msbuild.exe", "csc.exe", "odbcconf.exe", "xwizard.exe",
    "installutil.exe", "regasm.exe", "regsvcs.exe", "schtasks.exe", "at.exe"
]);
// Part 1: Installer/updater processes spawning suspicious child processes
let InstallerSpawnsLOLBin = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ (TrustedInstallerProcesses)
| where FileName in~ (LOLBins)
| extend DetectionSource = "InstallerSpawnedLOLBin"
| project Timestamp, DeviceName, AccountName,
         DetectionSource,
         ParentProcess = InitiatingProcessFileName,
         ParentCommandLine = InitiatingProcessCommandLine,
         ParentSHA1 = InitiatingProcessSHA1,
         ChildProcess = FileName,
         ChildCommandLine = ProcessCommandLine,
         ChildFolderPath = FolderPath;
// Part 2: Legitimate signed software spawning shells after a recent file write to its install directory
let SignedSoftwareSpawnsShell = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where InitiatingProcessFolderPath has_any ("Program Files", "Program Files (x86)", "ProgramData")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe")
| where InitiatingProcessVersionInfoCompanyName != ""
// Exclude common known-good parent patterns
| where not (InitiatingProcessFileName in~ ("explorer.exe", "svchost.exe", "services.exe", "taskhostw.exe"))
| extend DetectionSource = "TrustedSoftwareSpawnedShell"
| project Timestamp, DeviceName, AccountName,
         DetectionSource,
         ParentProcess = InitiatingProcessFileName,
         ParentCommandLine = InitiatingProcessCommandLine,
         ParentSHA1 = InitiatingProcessSHA1,
         ParentFolderPath = InitiatingProcessFolderPath,
         ParentCompany = InitiatingProcessVersionInfoCompanyName,
         ChildProcess = FileName,
         ChildCommandLine = ProcessCommandLine,
         ChildFolderPath = FolderPath;
// Combine both detection paths
InstallerSpawnsLOLBin
| project Timestamp, DeviceName, AccountName, DetectionSource, ParentProcess, ParentCommandLine, ParentSHA1, ChildProcess, ChildCommandLine
| union (
    SignedSoftwareSpawnsShell
    | project Timestamp, DeviceName, AccountName, DetectionSource, ParentProcess, ParentCommandLine, ParentSHA1, ChildProcess, ChildCommandLine
)
| sort by Timestamp desc

Detects supply chain compromise indicators by monitoring two key behavioral patterns: (1) software installer and updater processes (msiexec.exe, setup.exe, updater.exe, squirrel.exe, etc.) spawning LOLBins (cmd.exe, PowerShell, regsvr32.exe, etc.) — a strong indicator of trojanized installers executing embedded payloads; (2) legitimate signed software installed in Program Files directories spawning interactive shells unexpectedly, which may indicate a compromised software binary or DLL sideloading attack delivered via supply chain. Uses DeviceProcessEvents parent-child relationship analysis. Coverage spans Windows endpoints enrolled in Microsoft Defender for Endpoint.

critical severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

Legitimate software installers (especially older or enterprise software) that invoke cmd.exe or PowerShell as part of post-install configuration scripts or service registration
Software deployment platforms (SCCM, Intune, PDQ Deploy) that use msiexec.exe or setup.exe as wrappers that legitimately spawn PowerShell for configuration
Electron-based applications (VSCode, Slack, Teams) whose squirrel.exe updater spawns cmd.exe for delta patching operations
Development environment tools (Visual Studio, JetBrains, Eclipse) that run PowerShell or scripts as part of extension installation or project scaffolding
Third-party IT management agents (SolarWinds, ConnectWise, Kaseya) whose update mechanisms spawn child processes by design

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ImageLower=lower(Image)
// Part 1: Installer/updater spawning LOLBins
| eval InstallerParent=if(
    match(ParentImageLower, "(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|packageinstaller\.exe|softwareupdate\.exe|uninst\.exe)"),
    1, 0
  )
| eval SpawnedLOLBin=if(
    match(ImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)"),
    1, 0
  )
// Part 2: Trusted software in Program Files spawning shells
| eval TrustedParentPath=if(
    match(ParentImageLower, "(program files|programdata)") AND
    match(ImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)") AND
    NOT match(ParentImageLower, "(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)"),
    1, 0
  )
| eval SupplyChainScore=InstallerParent*SpawnedLOLBin + TrustedParentPath
| where SupplyChainScore > 0
| eval DetectionReason=case(
    InstallerParent=1 AND SpawnedLOLBin=1, "Installer/updater spawned LOLBin",
    TrustedParentPath=1, "Trusted software in ProgramFiles spawned shell",
    true(), "Unknown"
  )
| table _time, host, User, ParentImage, ParentCommandLine, Image, CommandLine, Hashes, DetectionReason, SupplyChainScore
| sort - _time

Detects supply chain compromise indicators using Sysmon Event ID 1 (Process Creation). Evaluates two behavioral patterns: (1) software installer and updater processes spawning LOLBins (Living Off The Land Binaries) as a signal of trojanized installer payloads, and (2) legitimate applications installed in Program Files or ProgramData directories spawning interactive shells. A SupplyChainScore is computed — higher scores indicate more suspicious behavior. Field extraction uses case-insensitive regex matching against ParentImage and Image fields.

critical severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Legitimate enterprise software installers that invoke PowerShell or cmd.exe for post-installation configuration tasks (SCCM packages, PDQ Deploy scripts)
Electron application updaters (squirrel.exe) that spawn cmd.exe as part of delta patching on Windows
Development IDEs (Visual Studio, JetBrains IDEs) that run shell scripts during extension or plugin installation
Security tools and monitoring agents that install via msiexec and invoke PowerShell for initial configuration and health checks
Software with embedded scripting engines (AutoIT, NSIS) that legitimately spawn cmd.exe as part of installation workflows

Elastic Security (EQL)

eql

sequence by host.id with maxspan=5m
  [process where event.type == "start" and
   process.parent.name : ("msiexec.exe", "setup.exe", "install.exe", "installer.exe",
     "update.exe", "updater.exe", "autoupdate.exe", "squirrel.exe",
     "appinstaller.exe", "packageinstaller.exe", "softwareupdate.exe",
     "uninst.exe", "uninstall.exe", "patchinstaller.exe") and
   process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
     "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe",
     "wmic.exe", "msbuild.exe", "csc.exe", "odbcconf.exe", "xwizard.exe",
     "installutil.exe", "regasm.exe", "regsvcs.exe", "schtasks.exe", "at.exe")
  ] by process.parent.entity_id

OR

process where event.type == "start" and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe") and
  process.parent.executable : ("*\\Program Files\\*", "*\\Program Files (x86)\\*", "*\\ProgramData\\*") and
  not process.parent.name : ("explorer.exe", "svchost.exe", "services.exe", "taskhostw.exe", "msiexec.exe", "setup.exe") and
  process.parent.code_signature.exists == true

Detects supply chain compromise post-delivery indicators: (1) trusted installer/updater processes spawning LOLBins as child processes, and (2) signed software resident in Program Files directories spawning shell interpreters. Both patterns are high-fidelity indicators of trojanized software executing a payload after installation via a trusted distribution mechanism.

high severity high confidence

Data Sources

Endpoint - Process Events (Elastic Agent / Auditbeat)

Required Tables

logs-endpoint.events.process-* winlogbeat-*

False Positives

Legitimate software installers that launch PowerShell post-install scripts for configuration (e.g., some enterprise security tools, developer SDKs)
Update mechanisms for developer tools (Node.js, Python, Visual Studio Code) that legitimately invoke cmd.exe or PowerShell as part of install/post-install hooks
Software packaging systems (Chocolatey, Scoop, Winget) whose wrappers are resident in Program Files and legitimately invoke shell processes

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "username",
  "sourceip",
  "hostname",
  QIDNAME(qid) AS event_name,
  "processname" AS child_process,
  "parentprocessname" AS parent_process,
  "commandline" AS child_cmdline,
  CASE
    WHEN LOWER("parentprocessname") MATCHES '(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|softwareupdate\.exe|uninst\.exe)'
      AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)'
      THEN 'Installer/updater spawned LOLBin'
    WHEN LOWER("parentprocesspath") MATCHES '.*(program files|programdata).*'
      AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)'
      AND NOT LOWER("parentprocessname") MATCHES '(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)'
      THEN 'Trusted software in ProgramFiles spawned shell'
    ELSE 'Unknown'
  END AS detection_reason
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 45)
  AND LONG(starttime) > (CURRENT_TIMESTAMP - 86400000)
  AND (
    (
      LOWER("parentprocessname") MATCHES '(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|softwareupdate\.exe|uninst\.exe)'
      AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)'
    )
    OR
    (
      LOWER("parentprocesspath") MATCHES '.*(program files|programdata).*'
      AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)'
      AND NOT LOWER("parentprocessname") MATCHES '(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)'
    )
  )
ORDER BY starttime DESC
LIMIT 500

AQL query detecting supply chain compromise post-delivery indicators by correlating Sysmon/Windows Security process creation events. Identifies installer/updater processes spawning LOLBins and signed software resident in Program Files directories launching shell interpreters. Uses LOGSOURCETYPEID filtering for Windows Sysmon (12) and Security Event Log (13/45) sources.

high severity medium confidence

Data Sources

Windows Sysmon (EventCode 1) Windows Security Event Log (EventCode 4688)

Required Tables

events

False Positives

Enterprise software deployment tools (SCCM, Intune, PDQ Deploy) that call installer processes and then launch scripts for configuration management
Security software (EDR agents, AV tools) residing in Program Files that spawn cmd.exe or PowerShell for update and quarantine operations
Developer environment installers (Visual Studio, JetBrains, Eclipse) that run post-install PowerShell scripts for environment setup or plugin installation

Sumo Logic CSE

sql

(_sourceCategory="endpoint/windows/sysmon" OR _sourceCategory="endpoint/windows/security")
| where EventID = "1" or EventCode = "1" or EventID = "4688"
| parse field=ParentImage "*\\*" as _discard, parent_exe nodrop
| parse field=Image "*\\*" as _discard, child_exe nodrop
| parse field=ParentCommandLine "*" as parent_cmdline nodrop
| parse field=CommandLine "*" as child_cmdline nodrop
| parse field=ParentImage "*" as parent_full_path nodrop
| eval parent_lower = toLowerCase(parent_exe)
| eval child_lower = toLowerCase(child_exe)
| eval parent_path_lower = toLowerCase(ParentImage)
// Branch 1: Installer spawning LOLBin
| eval is_installer_parent = if(matches(parent_lower, "msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|softwareupdate\.exe|uninst\.exe"), 1, 0)
| eval is_lolbin_child = if(matches(child_lower, "cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe"), 1, 0)
// Branch 2: Trusted software in Program Files spawning shell
| eval is_trusted_path_parent = if(matches(parent_path_lower, "program files|programdata"), 1, 0)
| eval is_shell_child = if(matches(child_lower, "cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe"), 1, 0)
| eval is_excluded_parent = if(matches(parent_lower, "explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe"), 1, 0)
| eval supply_chain_score = (is_installer_parent * is_lolbin_child) + (is_trusted_path_parent * is_shell_child * (1 - is_excluded_parent))
| where supply_chain_score > 0
| eval detection_reason = if(is_installer_parent = 1 and is_lolbin_child = 1, "Installer/updater spawned LOLBin",
    if(is_trusted_path_parent = 1 and is_shell_child = 1 and is_excluded_parent = 0, "Trusted software in ProgramFiles spawned shell", "Unknown"))
| fields _messageTime, Computer, host, User, ParentImage, parent_cmdline, Image, child_cmdline, Hashes, detection_reason, supply_chain_score
| sort by _messageTime desc

Sumo Logic CSE query detecting supply chain compromise through two behavioral patterns: installer/updater processes (msiexec, setup, update wrappers) spawning LOLBins, and signed/legitimate software resident in Program Files directories spawning shell interpreters. A risk score is computed from both patterns to reduce alert noise while maintaining coverage of both attack vectors.

high severity medium confidence

Data Sources

Endpoint - Windows Sysmon Endpoint - Windows Security Event Log

Required Tables

Sysmon EventCode 1 Windows Security EventCode 4688

False Positives

Legitimate software update pipelines (e.g., Electron app self-updaters using Squirrel.Windows) that spawn PowerShell for pre/post-update scripting
IT management agents (ManageEngine, Kaseya, ConnectWise) that install via MSI and then invoke shell commands for asset configuration or remediation
Software development kits that install CLI tooling via setup.exe and subsequently launch cmd.exe to add directories to PATH or configure shell profiles

Google Chronicle / SecOps

yaral

rule supply_chain_compromise_t1195 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects post-delivery supply chain compromise indicators: installer/updater processes spawning LOLBins, or trusted signed software in standard install paths launching shell interpreters"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1195"
    mitre_attack_subtechniques = "T1195.001, T1195.002, T1195.003"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-18"
    platform = "Windows"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.vendor_name = "Microsoft"

    // Capture parent and child process names
    $parent = $e.principal.process.file.full_path
    $child = $e.target.process.file.full_path
    $child_name = $e.target.process.file.basename
    $parent_name = $e.principal.process.file.basename

    // Branch 1: Installer/updater spawning LOLBin
    // Branch 2: Trusted software in Program Files spawning shell
    (
      (
        re.regex($e.principal.process.file.basename, `(?i)(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|packageinstaller\.exe|softwareupdate\.exe|uninst\.exe|uninstall\.exe|patchinstaller\.exe)`)
        and
        re.regex($e.target.process.file.basename, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|xwizard\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|schtasks\.exe|at\.exe)`)
      )
      or
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\Program Files\\|\\Program Files \(x86\)\\|\\ProgramData\\)`)
        and
        re.regex($e.target.process.file.basename, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)`)
        and
        not re.regex($e.principal.process.file.basename, `(?i)(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe|setup\.exe)`)
        and
        $e.principal.process.file.pe_file.company_name != ""
      )
    )

    $hostname = $e.principal.hostname
    $user = $e.principal.user.userid
    $parent_cmd = $e.principal.process.command_line
    $child_cmd = $e.target.process.command_line

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting supply chain compromise post-delivery behavioral indicators. Matches on two event patterns within process launch telemetry: trusted installer/updater binaries spawning LOLBins, and vendor-signed software resident in standard installation directories launching shell interpreters. Leverages UDM process launch event type with principal (parent) and target (child) process fields.

high severity high confidence

Data Sources

Endpoint - Windows Process Events (via Chronicle forwarder or Sysmon-to-UDM ingestion)

Required Tables

PROCESS_LAUNCH UDM events

False Positives

Software vendors that legitimately use Squirrel.Windows (Electron apps like Slack, Teams, Discord) whose squirrel.exe spawns PowerShell for installation hooks
Enterprise software (SAP, Oracle, Adobe) with complex install procedures that execute cmd.exe scripts from their Program Files directories during patching cycles
Security tools (CrowdStrike Falcon, SentinelOne, Carbon Black) that self-update from ProgramData paths and execute shell commands as part of sensor update processes

CrowdStrike LogScale (CQL)

cql

// Supply Chain Compromise - T1195
// Branch 1: Installer/updater spawning LOLBin
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|packageinstaller\.exe|softwareupdate\.exe|uninst\.exe|uninstall\.exe|patchinstaller\.exe)/
| ImageFileName = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|xwizard\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|schtasks\.exe|at\.exe)/
| DetectionReason := "Installer/updater spawned LOLBin"
| table([timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine, SHA256HashData, DetectionReason])

UNION

// Branch 2: Trusted software in Program Files spawning shell
#event_simpleName=ProcessRollup2
| ParentImageFileName = /(?i)(\\Program Files\\|\\Program Files \(x86\)\\|\\ProgramData\\)/
| ImageFileName = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)/
| ParentBaseFileName != /(?i)(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe|setup\.exe)/
| DetectionReason := "Trusted software in ProgramFiles spawned shell"
| table([timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine, SHA256HashData, DetectionReason])

// Combine and sort
| groupBy([timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine, SHA256HashData, DetectionReason], function=count(as=EventCount))
| sort(timestamp, order=desc)

CrowdStrike LogScale (CQL) detection for supply chain compromise using Falcon ProcessRollup2 events. Two branches are unioned: (1) installer and updater processes (msiexec, setup, squirrel, etc.) spawning LOLBins, and (2) vendor software resident in Program Files or ProgramData paths spawning shell interpreters. Both patterns indicate trojanized software executing attacker payloads via trusted delivery mechanisms.

high severity high confidence

Data Sources

CrowdStrike Falcon Endpoint - ProcessRollup2

Required Tables

ProcessRollup2

False Positives

Legitimate Electron application updaters (Slack, VS Code, GitHub Desktop) that use Squirrel.Windows and spawn PowerShell for delta patching and shortcut management
Software packaging and configuration management tools (Chef, Puppet agents, Ansible runner) installed under ProgramData that invoke cmd.exe or PowerShell for policy enforcement
Anti-malware and EDR products (residing in Program Files) that spawn shell processes during remediation, quarantine, or automated response playbook execution

Sigma rule & cross-platform mapping

The detection logic for Supply Chain Compromise (T1195) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1195 Sigma rules on detection.fyi

Platform-specific guides for T1195

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-18 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Trojanized Installer Spawning PowerShell (Windows)
Expected signal: Sysmon Event ID 1: Two process creation events — first for %TEMP%\setup.exe (Image matches 'setup.exe'), then for powershell.exe with ParentImage pointing to %TEMP%\setup.exe. Security Event ID 4688 (if command line auditing enabled) with same parent-child details. Sysmon Event ID 11: File creation for t1195_installer_test.txt.
Test 2Malicious npm Package Postinstall Script (Windows)
Expected signal: Sysmon Event ID 1: Process chain: npm.cmd (or node.exe) spawning cmd.exe with the postinstall command. The CommandLine will contain the postinstall script command. Sysmon Event ID 11: File creation for postinstall_output.txt in %TEMP%\t1195-npm\. Windows Event ID 4688 (process creation) for each spawned process.
Test 3Malicious Python Package setup.py Executing Shell Command (Linux/macOS)
Expected signal: Linux auditd: syscall execve events for python3 spawning subprocess (id command). Syslog/auditd EXECVE records showing python3 as parent process and id as child. If Falco is deployed, process_spawned_by_pip_or_python rules will fire. File creation event for /tmp/t1195-pip/pip_payload_output.txt.
Test 4Software Binary Hash Integrity Verification Failure Simulation (Windows)
Expected signal: Process creation events for certutil.exe (Sysmon Event ID 1) with -hashfile arguments. The fc command will show or report mismatches between the two hash files, demonstrating the hash divergence that would indicate a tampered supply chain binary. No network activity expected. This test validates the analyst investigation workflow rather than triggering a real-time detection rule.

Response Playbook

Triage

Identify the software that triggered the alert — note the installer/updater process name, full path, and command line. Was this triggered by a scheduled update, a manual install, or an unexpected execution?
Verify the digital signature of the triggering binary: in PowerShell run 'Get-AuthenticodeSignature -FilePath <path>' or use 'sigcheck.exe -v <path>' from Sysinternals. Check: Is it signed? Is the cert trusted? Is the cert recently issued (red flag for stolen signing certs)? Does the signer match the expected vendor?
Compare the binary hash against vendor-published checksums. For common tools: check the vendor's official download page or GitHub releases page. For Windows: use 'certutil -hashfile <path> SHA256'. A mismatch is a critical indicator of supply chain tampering.
Review the full parent-child process tree — trace back to the original execution trigger. Was the installer run from a user download, a software update service, a scheduled task, or pushed via SCCM/Intune? Map the full ancestry using DeviceProcessEvents filtered by DeviceName.
Examine the child process command line in detail — what is the spawned process doing? If PowerShell, decode any Base64. If cmd.exe, review the command for network activity, file writes, or registry modifications. Determine if the behavior matches the expected installer workflow.
Check for network connections from the installer/parent process around the same timestamp using DeviceNetworkEvents. Any outbound connections to non-vendor IPs, dynamic DNS domains, or unusual ports (not 80/443 to known CDN/vendor ranges) are high-confidence C2 indicators.
Determine scope — query DeviceProcessEvents across all devices to find whether the same installer/software binary triggered the same child process pattern on other endpoints. Widespread identical behavior suggests a compromised update package distributed at scale.

Containment

If the binary hash mismatches vendor checksums or the signature is invalid/from an unexpected certificate: immediately isolate the endpoint using EDR network isolation. Do not allow the software to run further.
Block the specific binary hash (SHA256) across all endpoints via EDR policy (Defender for Endpoint: indicator block, CrowdStrike: IOC management). This prevents execution on any other endpoint that may have received the same compromised package.
Block outbound network connections to any C2 domains or IPs identified in the post-installation network connections at the firewall, proxy, and DNS layer. Submit indicators to threat intelligence sharing platforms.
If a software update mechanism is confirmed compromised: immediately suspend the update service or software deployment pipeline across the organization. Push a policy via GPO or MDM to disable auto-updates for the affected product until vendor confirms a clean build.
If the compromised software is vendor-distributed: contact the vendor's security team immediately with the binary hashes, installation timestamps, and behavioral indicators. Check vendor security advisories for acknowledgment of a supply chain incident.
Preserve the compromised installer/binary as forensic evidence before any remediation — copy to an isolated evidence share with hash verification. This is critical for vendor escalation and law enforcement reporting.
If persistence was established (services, scheduled tasks, registry run keys created by the spawned process): enumerate and remove all persistence mechanisms before reimaging. Use Autoruns or DeviceRegistryEvents to enumerate changes made during the attack window.

Evidence Collection

Compromised binary: Collect the full installer or software binary from the affected endpoint. Record SHA1, SHA256, MD5, file size, creation timestamp, modification timestamp, and digital signature details.
Windows Installer logs: Check %TEMP%\MSI*.log (verbose installer logs) and C:\Windows\Logs\CBS\CBS.log. These record every action taken by msiexec.exe during installation.
Process execution chain: Pull all DeviceProcessEvents for the affected device in the ±2 hour window around the alert timestamp. Export with full command lines, hashes, parent/child relationships.
Windows Event ID 1033 from Application event log — MsiInstaller records product installs, upgrades, and removals with product name, version, and result code.
Windows Event ID 4697 (Security log) — New service installation events created during or after the compromised install.
Sysmon Event ID 11 (File Create): All files written to disk by the installer and any spawned processes. Focus on .exe, .dll, .ps1, .vbs, .bat, .cmd files written to system directories.
Sysmon Event ID 12/13/14 (Registry Create/Set/Delete): Registry modifications made by the installer process and its children, especially under HKLM\SYSTEM\CurrentControlSet\Services, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
Network forensics: Export all network connection events from DeviceNetworkEvents for the affected device during the install window. Collect full DNS query logs (Sysmon Event ID 22) for any domains resolved by the installer or spawned processes.
Software inventory snapshot: Run 'wmic product get name,version,installlocation,installldate' or 'Get-WmiObject -Class Win32_Product' to capture the full installed software state at time of investigation.
Prefetch files: C:\Windows\Prefetch\<INSTALLER_NAME>-*.pf records DLLs loaded and files accessed by the installer. Use WinPrefetchView or strings to extract referenced paths.

Escalation Criteria

! Binary hash of installed software does not match vendor-published checksums, or the Authenticode signature is from an unexpected or recently compromised certificate — confirmed tampered supply chain artifact
! The spawned child process establishes outbound network connections to non-vendor IPs or domains, especially to dynamic DNS services, newly registered domains (<30 days), or known threat actor infrastructure
! Multiple endpoints across the organization show the same installer spawning the same LOLBin command — indicates a compromised update distributed at scale, not a one-off local incident
! Post-installation process creates persistence mechanisms (scheduled tasks, services, registry run keys) that were not present before installation and are not part of the expected software functionality
! Credential dumping activity observed after the supply chain compromise (LSASS access, SAM registry hive reads, DPAPI decryption) — adversary has moved to credential harvesting phase
! Lateral movement indicators (SMB connections to other hosts, WMI remote execution, new admin account creation) originating from the compromised endpoint after the supply chain delivery

Investigation Guide

Forensic Artifacts

> Authenticode signature metadata: Use 'Get-AuthenticodeSignature' (PowerShell) or 'sigcheck.exe -v -a <path>' (Sysinternals) to extract signer, certificate chain, timestamp authority, and signature validity.
> Windows Installer database: C:\Windows\Installer\*.msi — original MSI packages cached by Windows Installer. Can be extracted to examine embedded custom actions and payload files.
> Windows Installer logs: %TEMP%\MSI*.log — verbose installation logs recording every file operation, registry change, and custom action execution with timestamps.
> Application Event Log — Event ID 1033 (MsiInstaller): Records product name, version, install result code, and whether it was an install, update, or removal.
> Security Event Log — Event ID 4697: Service created events, which may indicate persistence established by compromised installer.
> Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ — installed software inventory with install dates, versions, and install locations.
> Registry: HKLM\SYSTEM\CurrentControlSet\Services\ — all registered services; compare to pre-install baseline to identify new services added.
> Prefetch directory: C:\Windows\Prefetch\<BINARY>-*.pf — lists DLLs loaded and files accessed during first 10 seconds of execution, invaluable for understanding what a compromised installer actually touched.
> Amcache.hve: C:\Windows\AppCompat\Programs\Amcache.hve — records executable metadata (path, hash, compile time, publisher) for recently run binaries; useful for identifying unsigned or anomalous software.
> Shimcache (AppCompatCache): HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — records execution metadata for all binaries that Windows Application Compatibility subsystem tracked.

Tuning Guidance

Supply chain compromise detection requires careful baselining to avoid alert fatigue from legitimate software deployments. Begin by building an allowlist of known-good installer parent-child combinations in your environment: document which software legitimately spawns PowerShell (e.g., specific SCCM package IDs, Intune MDM enrollment scripts, known JetBrains IDE updaters), and create exclusions scoped to specific SHA256 hashes and command line patterns rather than broad process name exclusions. Never exclude an entire process name (e.g., 'all setup.exe activity') — always bind exclusions to specific file hashes. For the signed-software-spawns-shell detection, start by running in alert-only mode for two weeks and reviewing all positives to identify your environment's legitimate patterns before enabling response actions. Integrate software deployment windows: if SCCM pushes packages on Tuesday nights, that context should lower alert priority during those windows. For high-value targets (executives, IT admins, developers), consider applying zero-exclusion rules. Subscribe to the vendor security advisories mailing lists and the CISA Known Exploited Vulnerabilities catalog to proactively check whether any software in your environment has been flagged as supply-chain-compromised. Consider deploying application whitelisting (AppLocker, WDAC) which provides a complementary control that prevents unsigned or untrusted binaries from running regardless of their delivery vector.

Hunting Queries

Hunt for software installed in Program Files or ProgramData making outbound connections to multiple public IPs or unusual ports while excluding known-good CDN/update infrastructure. High-volume or multi-destination connections from trusted software paths may indicate a supply-chain-delivered backdoor performing C2 beaconing or data exfiltration.

Hunting — KQL

kql

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has_any ("Program Files", "Program Files (x86)", "ProgramData")
| where RemoteIPType == "Public"
// Exclude known-good software update infrastructure
| where RemoteUrl !has_any (".microsoft.com", ".windowsupdate.com", ".adobe.com", ".apple.com", ".google.com", ".amazon.com", ".akamaiedge.net", ".cloudfront.net")
| where RemotePort in (4444, 8080, 8443, 1337, 9999, 31337, 443, 80)
| summarize
    ConnectionCount = count(),
    UniqueRemoteIPs = dcount(RemoteIP),
    UniqueRemotePorts = dcount(RemotePort),
    Destinations = make_set(strcat(RemoteIP, ":", tostring(RemotePort)), 20),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessVersionInfoCompanyName
| where UniqueRemoteIPs > 1 or ConnectionCount > 10
| sort by ConnectionCount desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(Image, "(?i)(program files|programdata)")
| where NOT match(DestinationHostname, "(?i)(microsoft\.com|windowsupdate\.com|adobe\.com|apple\.com|google\.com|amazon\.com|akamai|cloudfront\.net)")
| where NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)")
| stats count as ConnectionCount, dc(DestinationIp) as UniqueIPs, values(DestinationPort) as Ports, values(DestinationHostname) as Hostnames by host, Image, Company
| where UniqueIPs > 1 OR ConnectionCount > 10
| sort - ConnectionCount

Hunt for trusted applications installed in Program Files loading DLLs from user-writable directories (AppData, Temp, Downloads, Desktop) or paths outside Windows and Program Files. This pattern is a strong indicator of DLL sideloading delivered via a supply chain compromise, where a malicious DLL is placed in the application's search path.

Hunting — KQL

kql

DeviceImageLoadEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has_any ("Program Files", "Program Files (x86)")
// DLL loaded from a user-writable or unexpected path
| where FolderPath has_any ("%APPDATA%", "%TEMP%", "\\Users\\", "\\Downloads\\", "\\Desktop\\")
    or (FolderPath !startswith "C:\\Windows" and FolderPath !startswith "C:\\Program Files")
| where not(SHA1 == "" or SHA1 == "0000000000000000000000000000000000000000")
| project Timestamp, DeviceName, AccountName,
         LoadingProcess = InitiatingProcessFileName,
         LoadingProcessPath = InitiatingProcessFolderPath,
         LoadedDLL = FileName,
         DLLPath = FolderPath,
         DLLSigner = InitiatingProcessVersionInfoCompanyName,
         SHA1
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
| where match(Image, "(?i)(program files|program files \\(x86\\))")
| where match(ImageLoaded, "(?i)(\\\\users\\\\|\\\\appdata\\\\|\\\\temp\\\\|\\\\downloads\\\\|\\\\desktop\\\\)")
    OR (NOT match(ImageLoaded, "(?i)(\\\\windows\\\\|\\\\program files)")
    AND NOT match(Signed, "(?i)true"))
| table _time, host, User, Image, ImageLoaded, Signed, Signature, Hashes
| sort - _time

Hunt for software installer and updater processes writing executable files (.exe, .dll, .ps1, .bat, .vbs) to unexpected locations such as Windows\Temp, user profile directories, or AppData paths. Legitimate installers write to Program Files or Windows directories; writing executables to temp or user-writable paths is a strong indicator of a trojanized installer dropping a secondary payload.

Hunting — KQL

kql

// Hunt for installer processes that created executable files in unusual locations
DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("msiexec.exe", "setup.exe", "installer.exe", "update.exe", "updater.exe", "squirrel.exe")
| where ActionType == "FileCreated"
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".bat" or FileName endswith ".vbs"
// Flag files written outside expected software installation paths
| where FolderPath has_any ("\\Windows\\Temp\\", "\\Users\\", "\\AppData\\", "\\Temp\\", "\\ProgramData\\Microsoft\\Windows\\")
    or (FolderPath !startswith "C:\\Program Files" and FolderPath !startswith "C:\\Windows")
| summarize
    FilesCreated = count(),
    UniqueExtensions = dcount(tolower(tostring(split(FileName, ".")[-1]))),
    Files = make_set(strcat(FolderPath, "\\", FileName), 20),
    Devices = dcount(DeviceName)
  by InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA1
| sort by FilesCreated desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(Image, "(?i)(msiexec\.exe|setup\.exe|installer?\.exe|updater?\.exe|squirrel\.exe)")
| where match(TargetFilename, "(?i)\.(exe|dll|ps1|bat|vbs|cmd)$")
| where match(TargetFilename, "(?i)(\\\\windows\\\\temp\\\\|\\\\users\\\\|\\\\appdata\\\\|\\\\programdata\\\\microsoft\\\\windows\\\\)")
    OR NOT match(TargetFilename, "(?i)(\\\\program files|\\\\windows)")
| stats count as FilesCreated, values(TargetFilename) as Files, dc(host) as Devices by Image, CommandLine, Hashes
| sort - FilesCreated

Atomic Red Team Tests

Test 1 Simulate Trojanized Installer Spawning PowerShell (Windows)

windows

Creates a copy of cmd.exe named 'setup.exe' in %TEMP% and executes it to spawn PowerShell with a benign command, simulating the behavior of a trojanized software installer that executes an embedded payload. This directly triggers the installer-spawns-LOLBin detection pattern. The setup.exe process creation followed by powershell.exe spawning will appear in Sysmon Event ID 1 logs with the expected parent-child relationship.

Command

powershell

copy %SystemRoot%\System32\cmd.exe %TEMP%\setup.exe && %TEMP%\setup.exe /c "powershell.exe -NoProfile -Command \"Write-Output 'T1195 atomic test - trojanized installer simulation' | Out-File $env:TEMP\t1195_installer_test.txt\""

Cleanup

powershell

del %TEMP%\setup.exe 2>nul & del %TEMP%\t1195_installer_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Two process creation events — first for %TEMP%\setup.exe (Image matches 'setup.exe'), then for powershell.exe with ParentImage pointing to %TEMP%\setup.exe. Security Event ID 4688 (if command line auditing enabled) with same parent-child details. Sysmon Event ID 11: File creation for t1195_installer_test.txt.

Expected Detection

KQL: InstallerSpawnsLOLBin alert fires — InitiatingProcessFileName='setup.exe', FileName='powershell.exe'. SPL: InstallerParent=1, SpawnedLOLBin=1, SupplyChainScore=1, DetectionReason='Installer/updater spawned LOLBin'.

Test 2 Malicious npm Package Postinstall Script (Windows)

windows

Simulates a compromised npm package executing system commands via a postinstall lifecycle hook. This is the attack vector used in numerous npm supply chain incidents (event-stream, node-ipc, colors.js). Creates a minimal npm package with a malicious postinstall script that runs whoami, then installs it locally. Represents T1195.001 (Compromise Software Dependencies).

Command

powershell

md %TEMP%\t1195-npm 2>nul && echo {"name":"t1195-sc-test","version":"1.0.0","scripts":{"postinstall":"cmd /c whoami > %TEMP%\t1195-npm\postinstall_output.txt"}} > %TEMP%\t1195-npm\package.json && npm install --prefix %TEMP%\t1195-npm %TEMP%\t1195-npm 2>&1

Cleanup

powershell

rmdir /s /q %TEMP%\t1195-npm 2>nul

Expected Telemetry

Sysmon Event ID 1: Process chain: npm.cmd (or node.exe) spawning cmd.exe with the postinstall command. The CommandLine will contain the postinstall script command. Sysmon Event ID 11: File creation for postinstall_output.txt in %TEMP%\t1195-npm\. Windows Event ID 4688 (process creation) for each spawned process.

Expected Detection

The node.exe or npm.cmd parent spawning cmd.exe may trigger the TrustedSoftwareSpawnedShell pattern if npm is installed in Program Files. The spawned cmd.exe executing whoami is a suspicious child process. Security tools with npm/Node.js supply chain rules (e.g., Falco, auditd) will alert on postinstall spawning system commands.

Test 3 Malicious Python Package setup.py Executing Shell Command (Linux/macOS)

linux

Simulates a compromised Python package using setup.py to execute system commands during installation, mimicking supply chain attacks like the 'ctx' and 'phpass' package compromises. Creates a minimal Python package with a malicious setup.py that calls subprocess.run() to execute 'id', then installs it. Represents T1195.001 (Compromise Software Dependencies).

Command

bash

mkdir -p /tmp/t1195-pip && cat > /tmp/t1195-pip/setup.py << 'SETUP_EOF'
import subprocess
from setuptools import setup
print('[T1195 atomic test] Simulating malicious setup.py execution')
result = subprocess.run(['id'], capture_output=True, text=True)
with open('/tmp/t1195-pip/pip_payload_output.txt', 'w') as f:
    f.write(result.stdout)
setup(name='t1195-test', version='1.0.0', packages=[])
SETUP_EOF
cd /tmp/t1195-pip && python3 setup.py install --user 2>&1

Cleanup

bash

rm -rf /tmp/t1195-pip ~/.local/lib/python*/site-packages/t1195_test* 2>/dev/null

Expected Telemetry

Linux auditd: syscall execve events for python3 spawning subprocess (id command). Syslog/auditd EXECVE records showing python3 as parent process and id as child. If Falco is deployed, process_spawned_by_pip_or_python rules will fire. File creation event for /tmp/t1195-pip/pip_payload_output.txt.

Expected Detection

Auditd rule 'execve by python3/python spawning id/whoami/uname' should fire. SPL query against linux_secure or syslog sourcetypes for python3 spawning system enumeration commands. The subprocess.run() call creating a child process from within pip install is the key behavioral indicator.

Test 4 Software Binary Hash Integrity Verification Failure Simulation (Windows)

windows

Simulates the detection of a tampered software binary by creating a copy of a legitimate Windows binary, modifying it (appending a null byte), and demonstrating how hash verification would detect the tampering. This validates the integrity checking workflow used during supply chain compromise investigation. In a real supply chain attack, the adversary's trojanized binary would fail hash verification against the vendor-published checksum.

Command

powershell

copy %SystemRoot%\System32\notepad.exe %TEMP%\notepad_vendor_copy.exe && echo. >> %TEMP%\notepad_vendor_copy.exe && certutil -hashfile %SystemRoot%\System32\notepad.exe SHA256 > %TEMP%\t1195_hash_original.txt && certutil -hashfile %TEMP%\notepad_vendor_copy.exe SHA256 > %TEMP%\t1195_hash_modified.txt && echo Original hash: && type %TEMP%\t1195_hash_original.txt && echo Modified hash: && type %TEMP%\t1195_hash_modified.txt && fc %TEMP%\t1195_hash_original.txt %TEMP%\t1195_hash_modified.txt && echo HASH MISMATCH DETECTED - supply chain tampering indicator || echo Hashes match

Cleanup

powershell

del %TEMP%\notepad_vendor_copy.exe %TEMP%\t1195_hash_original.txt %TEMP%\t1195_hash_modified.txt 2>nul

Expected Telemetry

Process creation events for certutil.exe (Sysmon Event ID 1) with -hashfile arguments. The fc command will show or report mismatches between the two hash files, demonstrating the hash divergence that would indicate a tampered supply chain binary. No network activity expected. This test validates the analyst investigation workflow rather than triggering a real-time detection rule.

Expected Detection

This atomic test validates the INVESTIGATION workflow, not a real-time detection rule. In a real supply chain compromise, the hash mismatch between the installed binary and the vendor-published checksum is the primary indicator. Integrate this hash comparison step into your incident response runbook for any supply chain compromise triage.

Related Detections

Tactic Hub

TA0001Initial Access

What is T1195 Supply Chain Compromise?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1195

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Sub-techniques (3)

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox