Detect Compromise Software Dependencies and Development Tools in Microsoft Sentinel

// T1195.001 — Compromised Software Dependencies: package manager spawning suspicious children + non-standard registry connections
let PackageManagerProcs = dynamic(["npm", "npm.cmd", "npm.exe", "node", "node.exe", "pip", "pip3", "pip.exe", "pip3.exe", "python", "python3", "python.exe", "python3.exe", "pipx", "yarn", "pnpm", "gem", "bundle", "cargo", "go", "nuget", "dotnet"]);
let SuspiciousChildProcs = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe"]);
let SuspiciousCommandPatterns = dynamic(["/dev/tcp", "base64 -d", "base64 --decode", "bash -i", "sh -i", "nc -e", "ncat -e", "python -c", "perl -e", "ruby -e", "DownloadString", "DownloadFile", "Invoke-Expression", "IEX(", "curl http", "wget http", "--registry http://", "--registry https://", "postinstall", "preinstall"]);
// Arm 1: Package managers spawning suspicious OS-level processes (postinstall/preinstall hook abuse)
let PackageManagerChildProc =
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName has_any (PackageManagerProcs)
    | where FileName has_any (SuspiciousChildProcs)
          or ProcessCommandLine has_any (SuspiciousCommandPatterns)
    | extend DetectionArm = "PackageManagerSpawnedSuspiciousChild"
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
             InitiatingProcessFileName, InitiatingProcessCommandLine,
             InitiatingProcessFolderPath, FolderPath, DetectionArm;
// Arm 2: Network connections from package manager child processes to non-standard or public IPs
let PackageManagerNetworkAnomalies =
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName has_any (PackageManagerProcs)
    | where RemoteIPType == "Public"
    | where not (RemoteUrl has_any ("registry.npmjs.org", "pypi.org", "files.pythonhosted.org", "rubygems.org", "crates.io", "nuget.org", "pkg.go.dev", "proxy.golang.org", "yarnpkg.com", "registry.yarnpkg.com"))
    | extend DetectionArm = "PackageManagerUnexpectedExternalConnection"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
             FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine,
             RemoteUrl, RemoteIP, RemotePort, RemoteIPType, DetectionArm;
// Arm 3: CI/CD workflow file modifications (GitHub Actions poisoning)
let CICDWorkflowModifications =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has_any (".github/workflows", ".gitlab-ci", "Jenkinsfile", ".circleci", ".travis", "azure-pipelines")
          or FileName has_any ("Makefile", "CMakeLists.txt", "build.gradle", "pom.xml") and ActionType in ("FileModified", "FileCreated")
    | where ActionType in ("FileModified", "FileCreated", "FileRenamed")
    | extend DetectionArm = "CICDPipelineFileModified"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
             FileName, FolderPath, ActionType,
             InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionArm;
// Union all arms
PackageManagerChildProc
| union PackageManagerNetworkAnomalies
| union CICDWorkflowModifications
| sort by Timestamp desc