Which SIEM platforms have a T1195.002 detection rule?

df00tech provides T1195.002 (Compromise Software Supply Chain) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Compromise Software Supply Chain (T1195.002)?

Detecting Compromise Software Supply Chain requires the following data sources: Process: Process Creation, Network Traffic: Network Connection Creation, File: File Creation, Microsoft Defender for Endpoint.

What severity and confidence is the T1195.002 detection?

The T1195.002 detection is rated high severity with medium confidence.

What are common false positives for T1195.002?

Common false positives for T1195.002 include: Legitimate software updaters that use PowerShell or cmd.exe as part of their post-install configuration (e.g., some enterprise software uses PowerShell for environment setup after MSI installation); Build systems that invoke utility scripts via cmd.exe or PowerShell during compilation steps — common in CI/CD pipelines where MSBuild calls post-build scripts; Software vendors using non-standard ports for update delivery (e.g., some enterprise patch management solutions use custom ports for update traffic).

T1195.002 IBM QRadar · QRadar

Detect Compromise Software Supply Chain in IBM QRadar

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Real-world examples include SUNSPOT injecting SUNBURST into SolarWinds Orion builds, CCBkdr backdooring CCleaner 5.33, and Sandworm replacing M.E.Doc updates with NotPetya. Detection focuses on post-installation behavioral anomalies: legitimate software exhibiting unexpected child process execution, unusual outbound connectivity, suspicious DLL loading, and credential access patterns that should never originate from trusted update mechanisms.

MITRE ATT&CK

Tactic: Initial Access
Technique: T1195 Supply Chain Compromise
Sub-technique: T1195.002 Compromise Software Supply Chain
Canonical reference: https://attack.mitre.org/techniques/T1195/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  destinationip,
  destinationport,
  LOWER("ParentProcessPath") AS parent_process,
  LOWER("ProcessPath") AS child_process,
  "CommandLine" AS command_line,
  "TargetFilePath" AS target_file,
  CASE
    WHEN LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msiexec|setup|install|installer|update|updater|autoupdate|softwareupdate|uninst|uninstall|patch|patchinstall)\.exe'
     AND LOWER(MATCHREGEX("ProcessPath", '[^\\/]+$')) SIMILAR TO '(powershell|pwsh|cmd|wscript|cscript|mshta|regsvr32|rundll32|certutil|bitsadmin|wmic|msbuild|installutil|regasm|cmstp|control)\.exe'
    THEN 'Installer_Spawned_Suspicious_Child'
    WHEN LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msbuild|devenv|cl|link|csc|vbc|dotnet)\.exe'
     AND LOWER(MATCHREGEX("ProcessPath", '[^\\/]+$')) SIMILAR TO '(powershell|pwsh|cmd|wscript|cscript|mshta|regsvr32|rundll32|certutil|bitsadmin|wmic|msbuild|installutil|regasm|cmstp|control)\.exe'
    THEN 'BuildTool_Spawned_Suspicious_Process'
    WHEN LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msiexec|setup|install|installer|update|updater|autoupdate|softwareupdate|uninst|uninstall|patch|patchinstall)\.exe'
     AND LOWER("TargetFilePath") SIMILAR TO '%(\\temp\\|\\appdata\\local\\temp\\|\\windows\\temp\\)%'
     AND LOWER("TargetFilePath") SIMILAR TO '%(exe|dll|ps1|bat|vbs|js)'
    THEN 'Updater_Dropped_Executable_In_Temp'
    WHEN LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msiexec|setup|install|installer|update|updater|autoupdate|softwareupdate|uninst|uninstall|patch|patchinstall)\.exe'
     AND destinationport NOT IN (80, 443, 8080, 8443)
     AND NOT (destinationip BETWEEN '10.0.0.0' AND '10.255.255.255'
         OR destinationip BETWEEN '172.16.0.0' AND '172.31.255.255'
         OR destinationip BETWEEN '192.168.0.0' AND '192.168.255.255')
    THEN 'Updater_Nonstandard_Port_Outbound'
    ELSE 'Unknown'
  END AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14, 15, 143, 352)
  AND starttime > NOW() - 1 DAYS
  AND (
    (LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msiexec|setup|install|installer|update|updater|autoupdate|softwareupdate|uninst|uninstall|patch|patchinstall)\.exe'
     AND LOWER(MATCHREGEX("ProcessPath", '[^\\/]+$')) SIMILAR TO '(powershell|pwsh|cmd|wscript|cscript|mshta|regsvr32|rundll32|certutil|bitsadmin|wmic|msbuild|installutil|regasm|cmstp|control)\.exe')
    OR
    (LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msbuild|devenv|cl|link|csc|vbc|dotnet)\.exe'
     AND LOWER(MATCHREGEX("ProcessPath", '[^\\/]+$')) SIMILAR TO '(powershell|pwsh|cmd|wscript|cscript|mshta|regsvr32|rundll32|certutil|bitsadmin|wmic)\.exe')
    OR
    (LOWER(MATCHREGEX("ParentProcessPath", '[^\\/]+$')) SIMILAR TO '(msiexec|setup|install|installer|update|updater|autoupdate|softwareupdate|uninst|uninstall|patch|patchinstall)\.exe'
     AND LOWER("TargetFilePath") SIMILAR TO '%(\\temp\\|\\windows\\temp\\|\\appdata\\local\\temp\\)%'
     AND LOWER("TargetFilePath") SIMILAR TO '%(exe|dll|ps1)')
  )
ORDER BY starttime DESC

critical severity medium confidence

QRadar AQL detection for T1195.002 supply chain compromise behavioral indicators. Queries Windows Security, Sysmon, and EDR log sources for installer/updater processes spawning suspicious child processes, build tools spawning LOLBins, update processes dropping executables in temp paths, and updater processes making outbound connections on non-standard ports.

Data Sources

IBM QRadar SIEMWindows Security Event LogSysmonMicrosoft Defender for Endpoint

Required Tables

events

False Positives & Tuning

Enterprise patch management solutions (WSUS, SCCM) invoking PowerShell for post-patch configuration on managed endpoints — correlate with change management tickets
Software vendors whose legitimate updaters use non-standard ports (e.g., some game launchers, creative software update services) — maintain an allowlist of known-good update endpoint IP/port pairs
CI/CD agents on developer workstations where msbuild.exe or dotnet.exe legitimately spawn cmd.exe/PowerShell for build scripts — scope detections to non-developer endpoint OUs

Download portable Sigma rule (.yml)

Other platforms for T1195.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Backdoored Installer Spawning PowerShell (Post-Install C2 Simulation)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=msiexec.exe, Image=powershell.exe, CommandLine containing '-WindowStyle Hidden' and 'Invoke-WebRequest'. Sysmon Event ID 3: Network Connection attempt from powershell.exe to 127.0.0.1:9999 (connection refused is acceptable). Security Event ID 4688 if command line auditing is enabled.
Test 2Simulate Build Tool Spawning Unexpected Shell (SUNSPOT-Style Build Injection)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=msbuild.exe (or cmd.exe spawned from the test fallback), Image=cmd.exe, CommandLine containing 'whoami'. Security Event ID 4688 with NewProcessName=cmd.exe, CreatorProcessName=msbuild.exe. File creation event for the output file in %TEMP%.
Test 3Simulate Supply Chain Malware Dropping Executable in Temp During Install
Expected signal: Sysmon Event ID 11: File Create with TargetFilename=%TEMP%\payload_stage2.exe, Image=powershell.exe. Sysmon Event ID 1: PowerShell spawning (parent chain visible). The file copy of calc.exe will have a known benign SHA256 but the file path in Temp will be flagged.
Test 4Verify Code Signing Certificate on Installed Binary (Supply Chain Investigation Validation)
Expected signal: Sysmon Event ID 1: PowerShell process spawned. No file modification events. The command performs read-only certificate inspection. PowerShell ScriptBlock Log Event ID 4104 captures the script content. This is purely a verification/investigation command.

Last updated: 2026-04-18 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1195.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Detect Compromise Software Supply Chain in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1195.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1195.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox