[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F2AD2WHPRCSKA0D3J5530":3,"skill-same:01M71F2AD2WHPRCSKA0D3J5530":63},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":14,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M71F2AD2WHPRCSKA0D3J5530","malware-supplychain-supply",null,"- [MITRE ATT&CK T1195 - Supply Chain Compromise](https:\u002F\u002Fattack.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-supplychain-supply\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30],"malware","supplychain","supply","malware supplychain supply","cybersecurity","https","ATT&CK","t1195","supply chain","chain","ck","attack","2026-11-10 10:12:30",false,"---\nname: malware-supplychain-supply\ndescription: \"- [MITRE ATT&CK T1195 - Supply Chain Compromise](https:\u002F\u002Fattack.\"\ndomain: cybersecurity\n---\n\n# Analyzing Supply Chain Malware Artifacts\n\n## Overview\n\nSupply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm\u002FPyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.\n\n## When to Use\n\n- When investigating security incidents that require analyzing supply chain malware artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `pefile`, `ssdeep`, `hashlib`\n- Binary diff tools (BinDiff, Diaphora)\n- Code signing verification tools (sigcheck, codesign)\n- Software composition analysis (SCA) tools\n- Access to legitimate software versions for comparison\n- Package repository monitoring (npm, PyPI, NuGet)\n\n## Workflow\n\n### Step 1: Binary Comparison Analysis\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Compare trojanized binary against legitimate version.\"\"\"\nimport hashlib\nimport pefile\nimport sys\nimport json\n\ndef compare_pe_files(legitimate_path, suspect_path):\n    \"\"\"Compare PE file structures between legitimate and suspect versions.\"\"\"\n    legit_pe = pefile.PE(legitimate_path)\n    suspect_pe = pefile.PE(suspect_path)\n\n    report = {\"differences\": [], \"suspicious_sections\": [], \"import_changes\": []}\n\n    # Compare sections\n    legit_sections = {s.Name.rstrip(b'\\x00').decode(): {\n        \"size\": s.SizeOfRawData,\n        \"entropy\": s.get_entropy(),\n        \"characteristics\": s.Characteristics,\n    } for s in legit_pe.sections}\n\n    suspect_sections = {s.Name.rstrip(b'\\x00').decode(): {\n        \"size\": s.SizeOfRawData,\n        \"entropy\": s.get_entropy(),\n        \"characteristics\": s.Characteristics,\n    } for s in suspect_pe.sections}\n\n    # Find new or modified sections\n    for name, props in suspect_sections.items():\n        if name not in legit_sections:\n            report[\"suspicious_sections\"].append({\n                \"name\": name, \"reason\": \"New section not in legitimate version\",\n                \"size\": props[\"size\"], \"entropy\": round(props[\"entropy\"], 2),\n            })\n        elif abs(props[\"size\"] - legit_sections[name][\"size\"]) > 1024:\n            report[\"suspicious_sections\"].append({\n                \"name\": name, \"reason\": \"Section size significantly changed\",\n                \"legit_size\": legit_sections[name][\"size\"],\n                \"suspect_size\": props[\"size\"],\n            })\n\n    # Compare imports\n    legit_imports = set()\n    if hasattr(legit_pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in legit_pe.DIRECTORY_ENTRY_IMPORT:\n            for imp in entry.imports:\n                if imp.name:\n                    legit_imports.add(f\"{entry.dll.decode()}!{imp.name.decode()}\")\n\n    suspect_imports = set()\n    if hasattr(suspect_pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in suspect_pe.DIRECTORY_ENTRY_IMPORT:\n            for imp in entry.imports:\n                if imp.name:\n                    suspect_imports.add(f\"{entry.dll.decode()}!{imp.name.decode()}\")\n\n    new_imports = suspect_imports - legit_imports\n    if new_imports:\n        report[\"import_changes\"] = list(new_imports)\n\n    # Check code signing\n    report[\"legit_signed\"] = bool(legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)\n    report[\"suspect_signed\"] = bool(suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)\n\n    return report\n\ndef hash_file(filepath):\n    \"\"\"Calculate multiple hashes for a file.\"\"\"\n    hashes = {}\n    with open(filepath, 'rb') as f:\n        data = f.read()\n    for algo in ['md5', 'sha1', 'sha256']:\n        h = hashlib.new(algo)\n        h.update(data)\n        hashes[algo] = h.hexdigest()\n    return hashes\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 3:\n        print(f\"Usage: {sys.argv[0]} \u003Clegitimate_binary> \u003Csuspect_binary>\")\n        sys.exit(1)\n    report = compare_pe_files(sys.argv[1], sys.argv[2])\n    print(json.dumps(report, indent=2))\n```\n\n## Validation Criteria\n\n- Trojanized components identified through binary diffing\n- Injected code isolated and analyzed separately\n- Code signing anomalies documented\n- Infection timeline reconstructed from build artifacts\n- Downstream impact scope assessed across affected systems\n- IOCs extracted for detection and blocking\n\n## References\n\n- [ReversingLabs - 3CX Supply Chain Analysis](https:\u002F\u002Fwww.reversinglabs.com\u002Fblog\u002Fwhat-went-wrong-with-the-3cx-software-supply-chain-attack-and-how-it-could-have-been-prevented)\n- [Fortinet - SolarWinds Supply Chain Attack](https:\u002F\u002Fwww.fortinet.com\u002Fresources\u002Fcyberglossary\u002Fsolarwinds-cyber-attack)\n- [Picus - 3CX SmoothOperator Analysis](https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fsmoothoperator-analysis-of-3cxdesktopapp-supply-chain-attack)\n- [MITRE ATT&CK T1195 - Supply Chain Compromise](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F)\n","# Analyzing Supply Chain Malware Artifacts\n\n## Overview\n\nSupply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm\u002FPyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.\n\n## When to Use\n\n- When investigating security incidents that require analyzing supply chain malware artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `pefile`, `ssdeep`, `hashlib`\n- Binary diff tools (BinDiff, Diaphora)\n- Code signing verification tools (sigcheck, codesign)\n- Software composition analysis (SCA) tools\n- Access to legitimate software versions for comparison\n- Package repository monitoring (npm, PyPI, NuGet)\n\n## Workflow\n\n### Step 1: Binary Comparison Analysis\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Compare trojanized binary against legitimate version.\"\"\"\nimport hashlib\nimport pefile\nimport sys\nimport json\n\ndef compare_pe_files(legitimate_path, suspect_path):\n    \"\"\"Compare PE file structures between legitimate and suspect versions.\"\"\"\n    legit_pe = pefile.PE(legitimate_path)\n    suspect_pe = pefile.PE(suspect_path)\n\n    report = {\"differences\": [], \"suspicious_sections\": [], \"import_changes\": []}\n\n    # Compare sections\n    legit_sections = {s.Name.rstrip(b'\\x00').decode(): {\n        \"size\": s.SizeOfRawData,\n        \"entropy\": s.get_entropy(),\n        \"characteristics\": s.Characteristics,\n    } for s in legit_pe.sections}\n\n    suspect_sections = {s.Name.rstrip(b'\\x00').decode(): {\n        \"size\": s.SizeOfRawData,\n        \"entropy\": s.get_entropy(),\n        \"characteristics\": s.Characteristics,\n    } for s in suspect_pe.sections}\n\n    # Find new or modified sections\n    for name, props in suspect_sections.items():\n        if name not in legit_sections:\n            report[\"suspicious_sections\"].append({\n                \"name\": name, \"reason\": \"New section not in legitimate version\",\n                \"size\": props[\"size\"], \"entropy\": round(props[\"entropy\"], 2),\n            })\n        elif abs(props[\"size\"] - legit_sections[name][\"size\"]) > 1024:\n            report[\"suspicious_sections\"].append({\n                \"name\": name, \"reason\": \"Section size significantly changed\",\n                \"legit_size\": legit_sections[name][\"size\"],\n                \"suspect_size\": props[\"size\"],\n            })\n\n    # Compare imports\n    legit_imports = set()\n    if hasattr(legit_pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in legit_pe.DIRECTORY_ENTRY_IMPORT:\n            for imp in entry.imports:\n                if imp.name:\n                    legit_imports.add(f\"{entry.dll.decode()}!{imp.name.decode()}\")\n\n    suspect_imports = set()\n    if hasattr(suspect_pe, 'DIRECTORY_ENTRY_IMPORT'):\n        for entry in suspect_pe.DIRECTORY_ENTRY_IMPORT:\n            for imp in entry.imports:\n                if imp.name:\n                    suspect_imports.add(f\"{entry.dll.decode()}!{imp.name.decode()}\")\n\n    new_imports = suspect_imports - legit_imports\n    if new_imports:\n        report[\"import_changes\"] = list(new_imports)\n\n    # Check code signing\n    report[\"legit_signed\"] = bool(legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)\n    report[\"suspect_signed\"] = bool(suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)\n\n    return report\n\ndef hash_file(filepath):\n    \"\"\"Calculate multiple hashes for a file.\"\"\"\n    hashes = {}\n    with open(filepath, 'rb') as f:\n        data = f.read()\n    for algo in ['md5', 'sha1', 'sha256']:\n        h = hashlib.new(algo)\n        h.update(data)\n        hashes[algo] = h.hexdigest()\n    return hashes\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 3:\n        print(f\"Usage: {sys.argv[0]} \u003Clegitimate_binary> \u003Csuspect_binary>\")\n        sys.exit(1)\n    report = compare_pe_files(sys.argv[1], sys.argv[2])\n    print(json.dumps(report, indent=2))\n```\n\n## Validation Criteria\n\n- Trojanized components identified through binary diffing\n- Injected code isolated and analyzed separately\n- Code signing anomalies documented\n- Infection timeline reconstructed from build artifacts\n- Downstream impact scope assessed across affected systems\n- IOCs extracted for detection and blocking\n\n## References\n\n- [ReversingLabs - 3CX Supply Chain Analysis](https:\u002F\u002Fwww.reversinglabs.com\u002Fblog\u002Fwhat-went-wrong-with-the-3cx-software-supply-chain-attack-and-how-it-could-have-been-prevented)\n- [Fortinet - SolarWinds Supply Chain Attack](https:\u002F\u002Fwww.fortinet.com\u002Fresources\u002Fcyberglossary\u002Fsolarwinds-cyber-attack)\n- [Picus - 3CX SmoothOperator Analysis](https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fsmoothoperator-analysis-of-3cxdesktopapp-supply-chain-attack)\n- [MITRE ATT&CK T1195 - Supply Chain Compromise](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1195\u002F)\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-supplychain-supply","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-supplychain-supply",{"tool":49,"command":50},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-supplychain-supply",{"tool":52,"command":53},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-supplychain-supply","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-supplychain-supply\u002FSKILL.md",true,[57],{"path":58,"resourceType":59,"resourceTypeDesc":60,"sizeBytes":61,"sourceHtmlUrl":62},"index.json","REFERENCE","参考文档",541,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-supplychain-supply\u002Findex.json",[64,89,112,134,156,172],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":31},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,23,88],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[96,71,97,74,98,99,100,23,101,102,103,104,105,106,76,107,108,109,110,111],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":31},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[119,120,121,122,123,124,23,101,125,102,126,127,76,109,128,129,130,131,132,133],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":31},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[72,141,142,143,144,145,146,77,147,23,88,148,149,150,151,152,153,154,155,76],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":31},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[163,164,72,165,143,145,166,77,167,147,23,88,102,168,169,170,171,155,76,78],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":31},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[179,72,143,180,166,77,181,182,23,88,183,184,185,186,187,188,76,78,189,190],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]