Compromise Software Supply Chain

Cybrary
Course

Threat actors use the technique Compromise Software Supply Chain by altering software that they know their victims will use. They include a backdoor that will give them access to their victim's network once the software is installed. You will detect this technique in a virtual lab and master how to mitigate this threat.

Time
1 hour 18 minutes
Difficulty
Intermediate
CEU/CPE
1
Share
NEED TO TRAIN YOUR TEAM? LEARN MORE
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Course Content
Module 1: APT29 Introduction
Campaign Overview
10m
Module 2: Compromise Software Supply Chain

2.1What is the “Compromise Software Supply Chain” Technique?

8m

2.2What is the “User Execution: Malicious Image” Technique?

5m

2.3What is “Event Triggered Execution: Accessibility Features?"

5m

2.4Detection, Validation, and Mitigation (Lab)

50m
Course Description

Supply chain attacks can have a major impact. By putting a backdoor into software that victims are known to use, threat actors can gain initial access and pave the way for their next steps. They also have the potential to target a large number of victims at once if they alter software that is widely used. This was the case with the 2020 SolarWinds attack. In that compromise, the attackers used a trojanized version of an update to the SolarWinds Orion Platform, which is an IT management software used by over 30,000 organizations. As such, the threat actors may have gained access to not only SolarWinds' clients' data, but potentially the data of those organizations' clients.

In this course, you will also learn about the techniques "User Execution: Malicious Image" and "Event Triggered Execution: Accessibility Features." The technique User Execution: Malicious Image involves the attacker relying on a user to run a malicious package of software (called an image) in order to deploy malware. The user typically assumes the image is legitimate based on how it is named. The last technique covered in this course, Event Triggered Execution: Accessibility Features, involves an attacker modifying the way certain accessibility features work that users can trigger using a key combination before logging in. In this way, the attacker can get access to a command prompt or backdoor without having to log into the system.

Learn how to detect and mitigate these techniques to protect your organization from this highly sophisticated type of attack.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT29. Prevent adversaries from accomplishing the tactic of initial access.

Instructed By
Chris Daywalt
Chris Daywalt
Security Freelancer
Instructor
Matthew Mullins
Matthew Mullins
Technical Manager, Red Team
Instructor
Provider
Cybrary
Certificate of Completion
Certificate Of Completion

Complete this entire course to earn a Compromise Software Supply Chain Certificate of Completion