T1195.002 Compromise Software Supply Chain
sub-techniqueEnterpriseAdversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (8)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- ID.IMImprovementmoderate · backed by 5 of 11 mapped controls
- ID.RARisk Assessmentmoderate · backed by 5 of 11 mapped controls
- PR.PSPlatform Securitymoderate · backed by 3 of 11 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (11)
Security controls that mitigate this.
known-exploited CVEs (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-4978US | high8.4OT critical | KEV | ||
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor m… | ||||
| CVE-2021-44529US | critical9.8OT critical | KEV | ||
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). | ||||
attack patterns (8)
CAPEC attack patterns that exploit this.
groups (9)
Threat groups associated with this.
software (3)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (17)
Sigma detection rules related to this.
source
Where this definition is published.