Detect Supply Chain Compromise in IBM QRadar
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can occur at any stage — from manipulation of development tools, source code repositories, open-source dependencies, software update/distribution mechanisms, system images, or physical hardware. Because the attack abuses trusted software distribution channels, defenders must focus on post-delivery behavioral indicators: trusted installer processes spawning shells, legitimate software making unexpected network connections, newly installed applications loading unsigned modules, and integrity failures in software binaries. High-profile incidents include SolarWinds Orion (Sunburst backdoor in update packages), CCleaner (backdoor distributed via official update), 3CX (second-order compromise via trojanized Electron app), and NotPetya (distributed via M.E.Doc accounting software update).
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1195 Supply Chain Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1195/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
"username",
"sourceip",
"hostname",
QIDNAME(qid) AS event_name,
"processname" AS child_process,
"parentprocessname" AS parent_process,
"commandline" AS child_cmdline,
CASE
WHEN LOWER("parentprocessname") MATCHES '(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|softwareupdate\.exe|uninst\.exe)'
AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)'
THEN 'Installer/updater spawned LOLBin'
WHEN LOWER("parentprocesspath") MATCHES '.*(program files|programdata).*'
AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)'
AND NOT LOWER("parentprocessname") MATCHES '(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)'
THEN 'Trusted software in ProgramFiles spawned shell'
ELSE 'Unknown'
END AS detection_reason
FROM events
WHERE
LOGSOURCETYPEID IN (12, 13, 45)
AND LONG(starttime) > (CURRENT_TIMESTAMP - 86400000)
AND (
(
LOWER("parentprocessname") MATCHES '(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|softwareupdate\.exe|uninst\.exe)'
AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)'
)
OR
(
LOWER("parentprocesspath") MATCHES '.*(program files|programdata).*'
AND LOWER("processname") MATCHES '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)'
AND NOT LOWER("parentprocessname") MATCHES '(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)'
)
)
ORDER BY starttime DESC
LIMIT 500AQL query detecting supply chain compromise post-delivery indicators by correlating Sysmon/Windows Security process creation events. Identifies installer/updater processes spawning LOLBins and signed software resident in Program Files directories launching shell interpreters. Uses LOGSOURCETYPEID filtering for Windows Sysmon (12) and Security Event Log (13/45) sources.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software deployment tools (SCCM, Intune, PDQ Deploy) that call installer processes and then launch scripts for configuration management
- Security software (EDR agents, AV tools) residing in Program Files that spawn cmd.exe or PowerShell for update and quarantine operations
- Developer environment installers (Visual Studio, JetBrains, Eclipse) that run post-install PowerShell scripts for environment setup or plugin installation
Other platforms for T1195
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Trojanized Installer Spawning PowerShell (Windows)
Expected signal: Sysmon Event ID 1: Two process creation events — first for %TEMP%\setup.exe (Image matches 'setup.exe'), then for powershell.exe with ParentImage pointing to %TEMP%\setup.exe. Security Event ID 4688 (if command line auditing enabled) with same parent-child details. Sysmon Event ID 11: File creation for t1195_installer_test.txt.
- Test 2Malicious npm Package Postinstall Script (Windows)
Expected signal: Sysmon Event ID 1: Process chain: npm.cmd (or node.exe) spawning cmd.exe with the postinstall command. The CommandLine will contain the postinstall script command. Sysmon Event ID 11: File creation for postinstall_output.txt in %TEMP%\t1195-npm\. Windows Event ID 4688 (process creation) for each spawned process.
- Test 3Malicious Python Package setup.py Executing Shell Command (Linux/macOS)
Expected signal: Linux auditd: syscall execve events for python3 spawning subprocess (id command). Syslog/auditd EXECVE records showing python3 as parent process and id as child. If Falco is deployed, process_spawned_by_pip_or_python rules will fire. File creation event for /tmp/t1195-pip/pip_payload_output.txt.
- Test 4Software Binary Hash Integrity Verification Failure Simulation (Windows)
Expected signal: Process creation events for certutil.exe (Sysmon Event ID 1) with -hashfile arguments. The fc command will show or report mismatches between the two hash files, demonstrating the hash divergence that would indicate a tampered supply chain binary. No network activity expected. This test validates the analyst investigation workflow rather than triggering a real-time detection rule.
References (10)
- https://attack.mitre.org/techniques/T1195/
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
- https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1195/T1195.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
- https://www.ncsc.gov.uk/collection/supply-chain-security
Unlock Pro Content
Get the full detection package for T1195 including response playbook, investigation guide, and atomic red team tests.