<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-compromised-build-tools
description: >-
  Detect compromised build tools including tampered compilers, modified
  build systems, malicious plugins, and supply chain attacks targeting
  the build environment itself (Thompson attack variants).
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - build-security
  - compiler-integrity
  - build-tools
  - thompson-attack
  - tool-verification
  - build-environment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Compromised Build Tools

## Overview

Compromised build tools represent one of the most insidious supply chain attacks
— a tampered compiler or build system can inject malicious code into every artifact
it produces without modifying source code (Ken Thompson's "Reflections on Trusting
Trust"). This skill covers verification of build tool integrity, detection of
modified compilers and plugins, and monitoring build environment consistency.

Mode: `[MODE: BLUE]` — Detect compromised build tools and verify build environment integrity.

## Prerequisites

| Requirement | Details |
|---|---|
| sha256sum / shasum for hash verification | Required |
| cosign for signature verification | Required |
| reproducible-builds tooling | Required |
| strace/dtrace for build process monitoring | Required |
| Python 3.10+ with `hashlib` | Required |

## Key Concepts

### Build Tool Integrity Verification

```bash
# Verify compiler hash against known-good
sha256sum $(which gcc) | tee current-gcc.sha256
# Compare against distribution's expected hash
apt show gcc 2>/dev/null | grep SHA256

# Verify npm/node integrity
sha256sum $(which node)
node -e "console.log(process.version, process.config.variables.node_module_version)"

# Verify Python interpreter
sha256sum $(which python3)
python3 -c "import sys; print(sys.version, sys.executable)"

# Check Go toolchain
go version
sha256sum $(which go)
```

### Build Plugin Auditing

```bash
# List installed npm global packages (potential build plugins)
npm list -g --depth=0 --json | jq '.dependencies | keys'

# List pip installed packages
pip list --format=json | jq '.[].name'

# Check Maven plugin integrity
mvn dependency:resolve-plugins -DoutputFile=plugins.txt

# List Gradle plugins
grep -rn 'plugin' build.gradle* | grep -v '//'
```

### Build Process Monitoring

```bash
# Monitor file access during build (Linux)
strace -f -e trace=open,openat,execve make 2>&1 | grep -v ENOENT | head -100

# Monitor network calls during build
strace -f -e trace=network make 2>&1 | grep connect

# Detect unexpected outbound connections during build
ss -tnp | grep "$(pgrep -f 'make\|npm\|pip\|go build')" 2>/dev/null

# Compare build outputs for reproducibility
sha256sum build/output-1 build/output-2
diff <(xxd build/output-1) <(xxd build/output-2) | head -50
```

## Workflow

### Step 1: Verify build tool integrity against known-good hashes

```bash
node scripts/agent.js --action verify --config /tmp/target --output /tmp/verify-result.json
```

### Step 2: Monitor build process for suspicious activity

```bash
node scripts/agent.js --action monitor --config /tmp/target --output /tmp/monitor-result.json
```

### Step 3: Generate build environment security report

```bash
node scripts/agent.js --action report --config /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Compromised Build Tools Detection
id: 3aaeaf74-5c1c-44b4-a2b6-8b6b416f610d
status: experimental
description: Detects suspicious activity related to detecting compromised build tools techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*compromised*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Compromised Build Tools Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All build tool hashes match expected distribution values
- [ ] No unauthorized build plugins or extensions installed
- [ ] Build process makes no unexpected network connections
- [ ] Build output is reproducible across clean environments
- [ ] Build environment configuration matches documented baseline

## References

- [Reproducible Builds](https://reproducible-builds.org/)
- [Ken Thompson — Reflections on Trusting Trust](https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflsectionsonTrustingTrust.pdf)
- [SLSA Build Requirements](https://slsa.dev/spec/v1.0/requirements)
- [Sigstore for Build Provenance](https://docs.sigstore.dev/)
