Detect Compromise Software Dependencies and Development Tools in Google Chronicle

rule t1195_001_supply_chain_compromise {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1195.001 supply chain compromise: package manager hook abuse spawning suspicious processes, unexpected external registry connections, and CI/CD pipeline file modifications"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1195.001"
    mitre_attack_technique_name = "Compromise Software Dependencies and Development Tools"
    severity = "HIGH"
    confidence = "MEDIUM"
    platform = "Windows, Linux, macOS"
    data_sources = "EDR, Process Telemetry, File Monitoring, Network Telemetry"
    version = "1.0"

  events:
    (
      // Arm 1a: Package manager process spawning suspicious OS-level child process
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e1.principal.process.file.full_path,
          `(?i)(npm\.cmd|npm\.exe|node\.exe|pip\.exe|pip3\.exe|python\.exe|python3\.exe|pipx\.exe|yarn\.exe|pnpm\.exe|gem\.exe|bundle\.exe|cargo\.exe|go\.exe|nuget\.exe|dotnet\.exe)$`)
        or re.regex($e1.principal.process.command_line,
          `(?i)(postinstall|preinstall|install\.js|setup\.py|node-pre-gyp)`)
      )
      and (
        re.regex($e1.target.process.file.full_path,
          `(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)$`)
        or re.regex($e1.target.process.command_line,
          `(?i)(/dev/tcp|base64 -d|base64 --decode|bash -i|sh -i|nc -e|ncat -e|python -c|perl -e|ruby -e|DownloadString|DownloadFile|Invoke-Expression|IEX\(|curl http|wget http|--registry http)`)
      )
    )
    or
    (
      // Arm 2: Package manager process making unexpected external network connection
      $e1.metadata.event_type = "NETWORK_CONNECTION"
      and re.regex($e1.principal.process.file.full_path,
        `(?i)(npm\.cmd|npm\.exe|node\.exe|pip\.exe|pip3\.exe|python\.exe|python3\.exe|yarn\.exe|pnpm\.exe|gem\.exe|bundle\.exe|cargo\.exe|go\.exe)$`)
      and $e1.network.direction = "OUTBOUND"
      and not re.regex($e1.target.hostname,
        `(?i)(registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org|rubygems\.org|crates\.io|nuget\.org|pkg\.go\.dev|proxy\.golang\.org|yarnpkg\.com|registry\.yarnpkg\.com)`)
    )
    or
    (
      // Arm 3: CI/CD pipeline configuration file creation or modification
      $e1.metadata.event_type = "FILE_CREATION"
      and (
        re.regex($e1.target.file.full_path,
          `(?i)(\.github/workflows|\.gitlab-ci|Jenkinsfile|\.circleci|\.travis|azure-pipelines)`)
        or re.regex($e1.target.file.full_path,
          `(?i)(Makefile|CMakeLists\.txt|build\.gradle|pom\.xml)$`)
      )
    )

  condition:
    $e1
}