Detect Compromise Hardware Supply Chain in Google Chronicle
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices such as servers, workstations, network infrastructure, or peripherals. Real-world examples include UEFI firmware implants (LoJax, CosmicStrand, BlackLotus), compromised network interface card firmware (Equation Group capabilities), and server baseboard management controller (BMC) implants. Detection is inherently constrained because the compromise predates the device's arrival, often manifesting as unexpected kernel-mode drivers, firmware modification activity, anomalous out-of-band management traffic, or covert network channels established through compromised NIC or BMC firmware. Defenders should focus on firmware integrity monitoring, hardware inventory baselining, driver signing verification, and anomalous network activity from system-level processes.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1195 Supply Chain Compromise
- Sub-technique
- T1195.003 Compromise Hardware Supply Chain
- Canonical reference
- https://attack.mitre.org/techniques/T1195/003/
YARA-L Detection Query
rule hardware_supply_chain_compromise_t1195_003 {
meta:
author = "Argus Detection Engineering"
description = "Detects T1195.003 hardware supply chain compromise: firmware flash utility execution, unsigned kernel drivers loaded from non-standard writable paths, and kernel driver service installation from suspicious locations."
mitre_attack_tactic = "Initial Access"
mitre_attack_technique = "T1195.003"
severity = "HIGH"
confidence = "MEDIUM"
reference = "https://attack.mitre.org/techniques/T1195/003/"
events:
(
(
// Branch 1: Firmware flash utility execution not initiated by known vendor updaters
$e.metadata.event_type = "PROCESS_LAUNCH" and
re.regex($e.target.process.file.full_path,
`(?i)(afuwin(64)?\.exe|afudos\.exe|fptw?(64)?\.exe|h2offt(-wx(64|86))?\.exe|flashrom\.exe|winphlash\.exe|phlash16\.exe|amifldrv64\.sys|meinfo(win)?(64)?\.exe|fwupdmgr\.exe|chipsec_main\.exe)`) and
not re.regex($e.principal.process.file.full_path,
`(?i)(msiexec\.exe|setup\.exe|install\.exe|update\.exe|dellupdate\.exe|hpfirmwareupdrecov\.exe|lenovo.*update\.exe)`)
) or
(
// Branch 2: Unsigned kernel driver loaded from non-standard writable path
$e.metadata.event_type = "DRIVER_LOAD" and
re.regex($e.target.file.full_path,
`(?i)\\(temp|appdata|programdata|users\\public|windows\\temp)\\`) and
$e.target.file.pe_file.signature_status != "SIGNED"
) or
(
// Branch 3: Kernel driver service created with image path in suspicious location
$e.metadata.event_type = "SERVICE_CREATION" and
re.regex($e.target.resource.name,
`(?i)\\(temp|appdata|programdata|windows\\temp)\\`) and
re.regex($e.target.resource.attribute.labels["ServiceType"],
`(?i)(kernel mode driver|file system driver)`)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1195.003 hardware supply chain compromise using the UDM event model. Covers three branches: firmware flash tool process launches not initiated by vendor update processes (PROCESS_LAUNCH), unsigned kernel drivers loaded from user-writable or temporary paths (DRIVER_LOAD), and kernel driver service creation pointing to non-standard image paths (SERVICE_CREATION). Maps to the same behavioral patterns as the KQL and SPL reference detections.
Data Sources
Required Tables
False Positives & Tuning
- OEM BIOS and firmware update workflows (HP BIOSphere, Dell BIOS Connect, Lenovo ThinkShield) where firmware utilities launch outside their standard vendor updater parent process chain due to rescheduled or deferred update execution
- IT asset provisioning pipelines that stage and execute firmware validation or update binaries in writable directories as part of automated hardware onboarding
- Open-source firmware audit tools (flashrom, chipsec) invoked by authorized hardware security teams under change-controlled conditions on non-production endpoints
Other platforms for T1195.003
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Firmware Inventory Tool Execution (Read-Only Audit)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_BIOS' and 'Win32_BaseBoard'. Security Event ID 4688 (if command line auditing enabled). Note: WMI queries also generate Event ID 4688 for wmiprvse.exe child processes.
- Test 2Simulate Firmware Flash Tool Execution From Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\Temp\AFUWINx64.EXE. Security Event ID 4688 with NewProcessName=C:\Windows\Temp\AFUWINx64.EXE. The OriginalFileName in PE headers will show cmd.exe (indicating the binary was renamed), which is an additional forensic signal.
- Test 3Inject Rogue PCI Device Registry Key
Expected signal: Sysmon Event ID 12 (Registry Key Create): TargetObject=HKLM\SYSTEM\CurrentControlSet\Enum\PCI\VEN_DEAD&DEV_BEEF&SUBSYS_00000000&REV_00, Image=powershell.exe. Sysmon Event ID 13 (Registry Value Set): TargetObject containing DeviceDesc. DeviceRegistryEvents in MDE will record ActionType=RegistryKeyCreated with InitiatingProcessFileName=powershell.exe.
- Test 4Install Kernel Driver Service From Temp Path
Expected signal: Windows System Event ID 7045 (New Service Installed): ServiceName=HWImplantTestDrv, ServiceType=kernel mode driver, StartType=demand start, ImagePath=C:\Windows\Temp\hw_implant_test.sys. Security Event ID 4697 (A service was installed in the system). The ImagePath pointing to \Windows\Temp\ is the primary anomaly indicator.
- Test 5Simulate BMC/IPMI Network Reconnaissance From Management Interface
Expected signal: Sysmon Event ID 1: Process Create with Image=curl.exe, User=SYSTEM (or NT AUTHORITY\SYSTEM). Sysmon Event ID 3: Network Connection attempted from curl.exe running as SYSTEM to 127.0.0.1:9876. DeviceNetworkEvents in MDE: InitiatingProcessAccountName=SYSTEM, RemotePort=9876.
References (10)
- https://attack.mitre.org/techniques/T1195/003/
- https://attack.mitre.org/techniques/T1195/
- https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/
- https://www.kaspersky.com/blog/cosmicstrand-uefi-rootkit/45292/
- https://www.binarly.io/posts/Black_Lotus_Unlocking_UEFI_Secure_Boot_Bypass/index.html
- https://github.com/chipsec/chipsec
- https://uefi.org/sites/default/files/resources/UEFI_Spec_2_9_2021_03_18.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1195.003/T1195.003.md
- https://eclypsium.com/blog/supply-chain-security-hardware-firmware/
- https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/csi-defending-against-hardware-supply-chain-threats.pdf
Unlock Pro Content
Get the full detection package for T1195.003 including response playbook, investigation guide, and atomic red team tests.