| ID | Name |
|---|---|
| T1474.001 | Compromise Software Dependencies and Development Tools |
| T1474.002 | Compromise Hardware Supply Chain |
| T1474.003 | Compromise Software Supply Chain |
Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.[1]
| ID | Name | Description |
|---|---|---|
| S0297 | XcodeGhost |
XcodeGhost was injected into apps by a modified version of Xcode (Apple's software development tool).[2][3] |
| ID | Mitigation | Description |
|---|---|---|
| M1013 | Application Developer Guidance |
Application developers should be cautious when selecting third-party libraries to integrate into their application. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0704 | Detection of Compromise Software Dependencies and Development Tools | AN1823 |
For Android, detect Compromise Software Dependencies and Development Tools by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App begins first-seen network connections to destinations matching known-malicious SDK C2 patterns or outside $SDKBaselineEndpoints$ for embedded SDK namespace]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1824 |
For iOS, detect Compromise Software Dependencies and Development Tools from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: Known app begins first-seen use of protected categories (analytics, location, contacts) matching known-SDK behavior patterns post-update]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |