Hunting For Supply Chain Compromise
FreeProactively detect supply chain threats in your environment.
Free · Opens the source repo
What Hunting For Supply Chain Compromise does
Hunting For Supply Chain Compromise is a skill designed for cybersecurity professionals aiming to detect and mitigate risks associated with compromised software supply chains. By leveraging existing threat intelligence and using a hypothesis-driven approach, this skill allows users to query Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) logs to identify potential indicators of compromise. This includes searching for trojanized software updates, unauthorized code modifications, and tampered build artifacts, which are critical in today's threat landscape where supply chain attacks are increasingly common.
The skill is particularly useful in scenarios where threat intelligence indicates active campaigns targeting software dependencies or during incident response efforts to scope potential compromises. It guides users through a structured workflow that begins with formulating a hypothesis based on threat intel, identifying relevant data sources, executing queries, and analyzing the results for anomalies. The skill ensures that findings are validated and correlated with broader attack patterns, enhancing the overall threat detection capabilities of the organization.
This skill is suitable for security analysts, incident responders, and threat hunters who are looking to enhance their detection methodologies. It requires a robust environment with EDR platforms that provide detailed telemetry and a SIEM capable of ingesting relevant logs. The skill's structured approach not only aids in immediate detection but also contributes to long-term improvements in security posture by documenting findings and updating detection rules.
Incorporating this skill into your cybersecurity toolkit can significantly bolster your defenses against sophisticated supply chain attacks, making it an essential resource for proactive threat hunting and incident response efforts.
When to use it
Use this skill when you need to proactively hunt for indicators of supply chain compromise, especially after receiving relevant threat intelligence.
When not to use it
This skill may not be suitable for environments without adequate EDR or SIEM capabilities, or for those not focused on supply chain security.
What you can build with it
Compromised Software Update
Use this skill to investigate a scenario where a vendor's software update may have been tampered with, leading to potential compromise.
Threat Intelligence Alert
Utilize this skill when threat intelligence indicates that a specific vendor or dependency has been compromised, allowing for targeted hunting.
Security Assessment
Incorporate this skill during periodic security assessments to evaluate the integrity of your build pipelines and software dependencies.
How to install Hunting For Supply Chain Compromise
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-supply-chain-compromise --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting For Supply Chain Compromise
When to Use
- When proactively hunting for indicators of hunting for supply chain compromise in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1195.001 | Compromise Software Dependencies |
| T1195.002 | Compromise Software Supply Chain |
| T1199 | Trusted Relationship |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: SolarWinds-style update mechanism compromise
- Scenario 2: Compromised npm/PyPI package with backdoor
- Scenario 3: Tampered build server deploying malicious artifacts
- Scenario 4: Vendor VPN software update delivering malware
Output Format
Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1195.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Hunting For Supply Chain Compromise
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.