hunting-for-supply-chain-compromise

name	hunting-for-supply-chain-compromise
description	Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting after threat intel flags a compromised vendor/dependency, scoping a build-pipeline compromise, or reviewing update/build integrity.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","supply-chain","initial-access","t1195","proactive-detection"]
version	1.0
author	mahipal
license