원클릭으로 Manus에서 모든 스킬 실행

hunting-for-supply-chain-compromise

스타21

포크1

업데이트2026년 7월 3일 14:43

Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

theheavenlyd3mon

theheavenlyd3mon/hermes-profiles

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Hunting For Supply Chain Compromise

When to Use

When proactively hunting for indicators of hunting for supply chain compromise in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

Concept	Description
T1195.001	Compromise Software Dependencies
T1195.002	Compromise Software Supply Chain
T1199	Trusted Relationship

Tools & Systems

Tool	Purpose
CrowdStrike Falcon	EDR telemetry and threat detection
Microsoft Defender for Endpoint	Advanced hunting with KQL
Splunk Enterprise	SIEM log analysis with SPL queries
Elastic Security	Detection rules and investigation timeline
Sysmon	Detailed Windows event monitoring
Velociraptor	Endpoint artifact collection and hunting
Sigma Rules	Cross-platform detection rule format

Common Scenarios

Scenario 1: SolarWinds-style update mechanism compromise
Scenario 2: Compromised npm/PyPI package with backdoor
Scenario 3: Tampered build server deploying malicious artifacts
Scenario 4: Vendor VPN software update delivering malware

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1195.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

이 저장소의 다른 Skills

같은 저장소

auditing-aws-s3-bucket-permissions

theheavenlyd3mon/hermes-profiles

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

2026-07-0321

auditing-azure-active-directory-configuration

theheavenlyd3mon/hermes-profiles

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

2026-07-0321

auditing-cloud-with-cis-benchmarks

theheavenlyd3mon/hermes-profiles

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

2026-07-0321

auditing-gcp-iam-permissions

theheavenlyd3mon/hermes-profiles

Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.

2026-07-0321

auditing-kubernetes-cluster-rbac

theheavenlyd3mon/hermes-profiles

Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.

2026-07-0321

auditing-terraform-infrastructure-for-security

theheavenlyd3mon/hermes-profiles

Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.

2026-07-0321

name	hunting-for-supply-chain-compromise
description	Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","supply-chain","initial-access","t1195","proactive-detection"]
version	1.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Platform Hardening","Restore Object","Restore Software","Software Update","Asset Inventory"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Supply Chain Compromise

When to Use

When proactively hunting for indicators of hunting for supply chain compromise in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

Concept	Description
T1195.001	Compromise Software Dependencies
T1195.002	Compromise Software Supply Chain
T1199	Trusted Relationship

Tools & Systems

Tool	Purpose
CrowdStrike Falcon	EDR telemetry and threat detection
Microsoft Defender for Endpoint	Advanced hunting with KQL
Splunk Enterprise	SIEM log analysis with SPL queries
Elastic Security	Detection rules and investigation timeline
Sysmon	Detailed Windows event monitoring
Velociraptor	Endpoint artifact collection and hunting
Sigma Rules	Cross-platform detection rule format

Common Scenarios

Scenario 1: SolarWinds-style update mechanism compromise
Scenario 2: Compromised npm/PyPI package with backdoor
Scenario 3: Tampered build server deploying malicious artifacts
Scenario 4: Vendor VPN software update delivering malware

Output Format

Hunt ID: TH-HUNTIN-[DATE]-[SEQ]
Technique: T1195.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]