Detect Supply Chain Compromise in Splunk
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can occur at any stage — from manipulation of development tools, source code repositories, open-source dependencies, software update/distribution mechanisms, system images, or physical hardware. Because the attack abuses trusted software distribution channels, defenders must focus on post-delivery behavioral indicators: trusted installer processes spawning shells, legitimate software making unexpected network connections, newly installed applications loading unsigned modules, and integrity failures in software binaries. High-profile incidents include SolarWinds Orion (Sunburst backdoor in update packages), CCleaner (backdoor distributed via official update), 3CX (second-order compromise via trojanized Electron app), and NotPetya (distributed via M.E.Doc accounting software update).
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1195 Supply Chain Compromise
- Canonical reference
- https://attack.mitre.org/techniques/T1195/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ImageLower=lower(Image)
// Part 1: Installer/updater spawning LOLBins
| eval InstallerParent=if(
match(ParentImageLower, "(msiexec\.exe|setup\.exe|install(er)?\.exe|update(r)?\.exe|autoupdate\.exe|squirrel\.exe|appinstaller\.exe|packageinstaller\.exe|softwareupdate\.exe|uninst\.exe)"),
1, 0
)
| eval SpawnedLOLBin=if(
match(ImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe|msbuild\.exe|csc\.exe|odbcconf\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)"),
1, 0
)
// Part 2: Trusted software in Program Files spawning shells
| eval TrustedParentPath=if(
match(ParentImageLower, "(program files|programdata)") AND
match(ImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe)") AND
NOT match(ParentImageLower, "(explorer\.exe|svchost\.exe|services\.exe|taskhostw\.exe|msiexec\.exe)"),
1, 0
)
| eval SupplyChainScore=InstallerParent*SpawnedLOLBin + TrustedParentPath
| where SupplyChainScore > 0
| eval DetectionReason=case(
InstallerParent=1 AND SpawnedLOLBin=1, "Installer/updater spawned LOLBin",
TrustedParentPath=1, "Trusted software in ProgramFiles spawned shell",
true(), "Unknown"
)
| table _time, host, User, ParentImage, ParentCommandLine, Image, CommandLine, Hashes, DetectionReason, SupplyChainScore
| sort - _timeDetects supply chain compromise indicators using Sysmon Event ID 1 (Process Creation). Evaluates two behavioral patterns: (1) software installer and updater processes spawning LOLBins (Living Off The Land Binaries) as a signal of trojanized installer payloads, and (2) legitimate applications installed in Program Files or ProgramData directories spawning interactive shells. A SupplyChainScore is computed — higher scores indicate more suspicious behavior. Field extraction uses case-insensitive regex matching against ParentImage and Image fields.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate enterprise software installers that invoke PowerShell or cmd.exe for post-installation configuration tasks (SCCM packages, PDQ Deploy scripts)
- Electron application updaters (squirrel.exe) that spawn cmd.exe as part of delta patching on Windows
- Development IDEs (Visual Studio, JetBrains IDEs) that run shell scripts during extension or plugin installation
- Security tools and monitoring agents that install via msiexec and invoke PowerShell for initial configuration and health checks
- Software with embedded scripting engines (AutoIT, NSIS) that legitimately spawn cmd.exe as part of installation workflows
Other platforms for T1195
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Trojanized Installer Spawning PowerShell (Windows)
Expected signal: Sysmon Event ID 1: Two process creation events — first for %TEMP%\setup.exe (Image matches 'setup.exe'), then for powershell.exe with ParentImage pointing to %TEMP%\setup.exe. Security Event ID 4688 (if command line auditing enabled) with same parent-child details. Sysmon Event ID 11: File creation for t1195_installer_test.txt.
- Test 2Malicious npm Package Postinstall Script (Windows)
Expected signal: Sysmon Event ID 1: Process chain: npm.cmd (or node.exe) spawning cmd.exe with the postinstall command. The CommandLine will contain the postinstall script command. Sysmon Event ID 11: File creation for postinstall_output.txt in %TEMP%\t1195-npm\. Windows Event ID 4688 (process creation) for each spawned process.
- Test 3Malicious Python Package setup.py Executing Shell Command (Linux/macOS)
Expected signal: Linux auditd: syscall execve events for python3 spawning subprocess (id command). Syslog/auditd EXECVE records showing python3 as parent process and id as child. If Falco is deployed, process_spawned_by_pip_or_python rules will fire. File creation event for /tmp/t1195-pip/pip_payload_output.txt.
- Test 4Software Binary Hash Integrity Verification Failure Simulation (Windows)
Expected signal: Process creation events for certutil.exe (Sysmon Event ID 1) with -hashfile arguments. The fc command will show or report mismatches between the two hash files, demonstrating the hash divergence that would indicate a tampered supply chain binary. No network activity expected. This test validates the analyst investigation workflow rather than triggering a real-time detection rule.
References (10)
- https://attack.mitre.org/techniques/T1195/
- https://www.mandiant.com/resources/blog/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
- https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities
- https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1195/T1195.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceimageloadevents-table
- https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck
- https://www.ncsc.gov.uk/collection/supply-chain-security
Unlock Pro Content
Get the full detection package for T1195 including response playbook, investigation guide, and atomic red team tests.