Detect Supply Chain Compromise in Google Chronicle

rule supply_chain_compromise_t1195 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects post-delivery supply chain compromise indicators: installer/updater processes spawning LOLBins, or trusted signed software in standard install paths launching shell interpreters"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1195"
    mitre_attack_subtechniques = "T1195.001, T1195.002, T1195.003"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-18"
    platform = "Windows"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.vendor_name = "Microsoft"

    // Capture parent and child process names
    $parent = $e.principal.process.file.full_path
    $child = $e.target.process.file.full_path
    $child_name = $e.target.process.file.basename
    $parent_name = $e.principal.process.file.basename

    // Branch 1: Installer/updater spawning LOLBin
    // Branch 2: Trusted software in Program Files spawning shell
    (
      (
        re.regex($e.principal.process.file.basename, `(?i)(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|packageinstaller\.exe|softwareupdate\.exe|uninst\.exe|uninstall\.exe|patchinstaller\.exe)`)
        and
        re.regex($e.target.process.file.basename, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|xwizard\.exe|installutil\.exe|regasm\.exe|regsvcs\.exe|schtasks\.exe|at\.exe)`)
      )
      or
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\Program Files\\|\\Program Files \(x86\)\\|\\ProgramData\\)`)
        and
        re.regex($e.target.process.file.basename, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)`)
        and
        not re.regex($e.principal.process.file.basename, `(?i)(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe|setup\.exe)`)
        and
        $e.principal.process.file.pe_file.company_name != ""
      )
    )

    $hostname = $e.principal.hostname
    $user = $e.principal.user.userid
    $parent_cmd = $e.principal.process.command_line
    $child_cmd = $e.target.process.command_line

  condition:
    $e
}