kevmap

Techniques › T1195 › T1195.002

T1195.002 Compromise Software Supply Chain

initial access — Linux, Windows, macOS · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
17
Sigma rules tagged attack.t1195.002
2
KEV CVEs mapped here
<p>Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.</p><p>Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2024-4978Justice AV Solutions Viewer exploitation technique Mapped2024-05-29
CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) primary impact Mapped2024-03-25

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1195.002

Axios NPM Compromise Indicators - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Techniques: T1195.002T1059.006T1059.004T1105
Notepad++ Updater DNS Query to Uncommon Domains mediumexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure. This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Techniques: T1195.002T1557
TanStack Supply-Chain Attack File Creation Indicators - Linux mediumexperimental
Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Techniques: T1195.002T1059.007T1547.004
Axios NPM Compromise File Creation Indicators - MacOS highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=macos category=file_event · 2db0458c-05c9-4069-a26f-77becd9c8c13
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Techniques: T1195.002T1105
LiteLLM / TeamPCP Supply Chain Attack Indicators highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-30 · logsource: product=linux category=process_creation · 36603778-030c-43c4-8cbb-cd3c1d1a80c7
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Techniques: T1195.002T1560.001T1543.002
Uncommon File Created by Notepad++ Updater Gup.EXE highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Techniques: T1195.002T1557
Shai-Hulud 2.0 Malicious NPM Package Installation - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-28 · logsource: product=linux category=process_creation · 514f533b-f56e-421d-80b0-f7706a3e9d23
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Techniques: T1195.002
Shai-Hulud Malicious Bun Execution highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Techniques: T1195.002T1203
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-30 · logsource: product=linux category=file_event · 81c0b7f5-81c9-435e-a291-bc32fc2b72cd
Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Techniques: T1543.002T1195.002
TanStack Supply-Chain Attack File Creation Indicators - Windows mediumexperimental
Author: Leonardo Gasparini · 2026-05-12 · logsource: product=windows category=file_event · 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
Techniques: T1195.002T1059.007T1554
Axios NPM Compromise Indicators - macOS highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Techniques: T1195.002T1059.002T1059.004T1105
Axios NPM Compromise File Creation Indicators - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=file_event · b7cb840c-11f6-47f7-b3ef-5524739c9077
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Techniques: T1195.002T1105
Shai-Hulud 2.0 Malicious NPM Package Installation highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-28 · logsource: product=windows category=process_creation · bae7c70b-8569-44e9-accf-b30073da8a5d
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Techniques: T1195.002
Suspicious Child Process of Notepad++ Updater - GUP.Exe highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe). This could indicate potential exploitation of the updater component to deliver unwanted malware.
Techniques: T1195.002T1557
Axios NPM Compromise File Creation Indicators - Windows highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=windows category=file_event · cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
Techniques: T1195.002
Shai-Hulud Malicious Bun Execution - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · eb827bbd-670a-4d58-8446-c464d8ac2323
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Techniques: T1195.002T1203
Axios NPM Compromise Indicators - Windows highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=windows category=process_creation · f6c27ecc-d890-4452-80e6-2e274a10e097
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
Techniques: T1195.002T1059.003T1059.005T1105

Rules tagged at the parent level (attack.t1195) 1

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Octopus Scanner Malware hightest
Author: NVISO · 2020-06-09 (modified 2021-11-27) · logsource: product=windows category=file_event · 805c55d9-31e6-4846-9878-c34c75054fe9
Detects Octopus Scanner Malware.
Techniques: T1195T1195.001