Skip to content
Install MCP

MITRE ATT&CK sub-technique

T1195.002 — Compromise Software Supply Chain

Last fetched

T1195.002 (Compromise Software Supply Chain) is a MITRE ATT&CK sub-technique tracked in WhisperGraph, serving the Initial Access tactic.

Description

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)

Tactics

Related techniques

Parent technique: T1195 · Supply Chain Compromise

Threat actors observed using this technique

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from T1195.002 into its tactic, related techniques and the actors that use it.

Queries

Resolves the segment to this technique or tactic.


MATCH (t:ATTACK_PATTERN {name: $id})
RETURN t.id AS id, t.name AS name, t.kind AS kind, t.description AS description
Run yourself →

The tactic(s) this technique serves.


MATCH (t:ATTACK_PATTERN {name: $id})-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN tac.id AS id, tac.name AS name
LIMIT 10
Run yourself →

This id's parent technique, if it is a sub-technique.


MATCH (p:ATTACK_PATTERN {name: $parentId})
RETURN p.id AS id, p.name AS name
LIMIT 1
Run yourself →

Sub-techniques of this technique, if any.


MATCH (c:ATTACK_PATTERN) WHERE c.id STARTS WITH $subPrefix
RETURN c.id AS id, c.name AS name
ORDER BY c.id
LIMIT 25
Run yourself →

Threat actors observed using this technique.


MATCH (a:ACTOR)-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN {name: $id})
RETURN a.name AS name
LIMIT 100
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.