skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-supply-chain-compromise

Detects supply chain compromise indicators including trojanized updates, compromised dependencies, and tampered build artifacts.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#supply chain#siem#edr#mitre attack#t1195
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-supply-chain-compromise
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-supply-chain-compromise
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-supply-chain-compromise
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-supply-chain-compromise

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to detect supply chain attacks like SolarWinds-style trojanized updates and compromised npm/PyPI packages, which evade signature checks and traditional detection rules. This Skill provides a structured threat hunting workflow to proactively identify these indicators across EDR, SIEM, and Sysmon telemetry.

Core Features & Use Cases

  • Hypothesis-Driven Hunting: Guides analysts through formulating hypotheses, identifying data sources, executing queries, and validating findings for MITRE ATT&CK techniques T1195.001, T1195.002, and T1199.
  • Detection Gap Coverage: Addresses blind spots such as signed-but-trojanized updates, DLL side-loading, and build-time dependency compromise on CI/CD agents.
  • Use Case: After threat intelligence reports a campaign abusing software updates, an analyst uses this Skill to hunt Sysmon Event ID 3 and 7 anomalies across endpoints and build servers, then documents findings in a standardized hunt report.

Quick Start

Hunt for supply chain compromise indicators on our Windows endpoints and build servers using Sysmon and EDR telemetry, focusing on trojanized software updates and compromised dependencies.

Frequently Asked Questions about hunting-for-supply-chain-compromise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hunt for supply chain compromise in my environment?▼

Start by formulating a hypothesis based on threat intelligence, then query EDR and SIEM data for anomalies like signed applications opening new C2 connections or unexpected DLL loads. Validate findings against known-good baselines and document results in a structured hunt report.

What tools are needed for supply chain threat hunting?▼

The workflow uses CrowdStrike Falcon or Microsoft Defender for Endpoint for EDR telemetry, Splunk or Elastic for SIEM analysis, Sysmon for detailed Windows event monitoring, and Velociraptor for endpoint artifact collection. Sigma rules provide cross-platform detection logic.

Why do signed software updates still pose a supply chain risk?▼

Signed-but-trojanized updates like the SolarWinds backdoor pass Authenticode signature validation, so signature checks alone are insufficient. Hunt for behavioral deviations instead, such as a signed application spawning script interpreters or making new outbound network connections.

Does this hunt cover compromised npm or PyPI packages?▼

Yes, dependency compromise via npm/PyPI postinstall scripts and typosquatting is a covered scenario. Note that these execute at build or install time on developer and CI hosts, so the hunt scope must extend to build agents, not just production endpoints.

How do I reduce false positives when hunting update mechanism abuse?▼

Baseline normal updater network destinations and expected signed-module load paths before hunting. Validate detections by staging a benign updated binary that makes a new outbound connection and confirming Sysmon Event ID 3 or 7 fires as expected.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
UnitOneAIUnitOneAI
44

ir-playbook

Execute structured incident response workflows with NIST SP 800-61 Rev 2 and SANS mapping.

Official
Intermediate
limit5limit5

SKILL_HD_CVE_IMPACT

Map CVE entries to affected components in a Software Bill of Materials.

Community
Intermediate
bouwerpbouwerp

threat-hunting-sigma

Interpret and adapt Sigma rules for SIEM-based threat hunting.

Community
Advanced