T0862 Supply Chain Compromise — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0730 Detection of Supply Chain Compromise

AN1863 Analytic 1863

Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2109 Analytic 2109

Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.

AN2111 Analytic 2111

Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2189 Analytic 2189

Real-time monitoring identifies a network infrastructure device exhibiting behavioral anomalies (unexpected listening ports, new routing entries) after a vendor firmware update or hardware replacement, where the device firmware hash does not match the authorized inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.