<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-supply-chain-threat-intelligence
description: >-
  Assess supply chain threats including software dependency risks, third-party
  compromise vectors, vendor security posture evaluation, and supply chain attack
  pattern analysis mapped to MITRE ATT&CK.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - supply-chain
  - third-party-risk
  - software-dependencies
  - sbom
  - vendor-risk
  - supply-chain-attack
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195"]
---
# Analyzing Supply Chain Threat Intelligence

## Overview

Supply chain threat intelligence assesses risks from third-party software,
hardware, and service providers. This skill covers analyzing software dependency
vulnerabilities (SBOM analysis), monitoring vendor compromise indicators, tracking
supply chain attack campaigns (SolarWinds, Codecov, 3CX), and building vendor
risk scorecards with threat-informed prioritization.

## Prerequisites

- Python 3.10+ with `requests`, `packageurl-python`, `cyclonedx-python-lib` libraries
- Access to NVD, OSV, and GitHub Advisory Database APIs
- SBOM files (CycloneDX or SPDX format) for dependency analysis
- Understanding of supply chain attack vectors (T1195 sub-techniques)
- Vendor management data for third-party risk assessment

```bash
pip install requests packageurl-python cyclonedx-python-lib
```

## Key Concepts

### Supply Chain Attack Vectors (ATT&CK T1195)

| Sub-technique | Description | Notable Example |
|---------------|-------------|-----------------|
| T1195.001 | Compromise software dependencies | event-stream (npm) |
| T1195.002 | Compromise software supply chain | SolarWinds SUNBURST |
| T1195.003 | Compromise hardware supply chain | Supermicro allegations |
| T1195 (general) | Supply chain compromise | 3CX, Codecov, Kaseya |

### SBOM Analysis Pipeline

```
Source Code → Build System → SBOM Generation (CycloneDX/SPDX) →
Dependency Resolution → Vulnerability Scanning (NVD/OSV) →
Risk Scoring → Remediation Prioritization
```

### Vendor Risk Dimensions

- **Security posture**: SOC2, ISO 27001, penetration test history
- **Data access**: what data the vendor processes/stores
- **Integration depth**: API access, network connectivity, admin privileges
- **Incident history**: past breaches, response quality, transparency
- **Dependency chain**: the vendor's own third-party dependencies

## Workflow

### Step 1: SBOM Vulnerability Analysis

```python
import requests

def scan_sbom_vulnerabilities(sbom_file: str) -> list[dict]:
    """Scan SBOM components against OSV vulnerability database."""
    import json
    with open(sbom_file) as f:
        sbom = json.load(f)

    vulnerabilities = []
    for component in sbom.get("components", []):
        purl = component.get("purl", "")
        if not purl:
            continue
        resp = requests.post(
            "https://api.osv.dev/v1/query",
            json={"package": {"purl": purl}},
            timeout=15,
        )
        if resp.status_code == 200:
            vulns = resp.json().get("vulns", [])
            for v in vulns:
                vulnerabilities.append({
                    "component": component.get("name", ""),
                    "version": component.get("version", ""),
                    "vuln_id": v.get("id", ""),
                    "summary": v.get("summary", ""),
                    "severity": v.get("database_specific", {}).get("severity", ""),
                })
    return vulnerabilities
```

### Step 2: Dependency Risk Scoring

```python
def score_dependency_risk(component: dict, vulns: list[dict]) -> dict:
    """Score a dependency's risk based on vulnerabilities and metadata."""
    vuln_count = len([v for v in vulns if v["component"] == component["name"]])
    critical_count = len([
        v for v in vulns
        if v["component"] == component["name"] and v.get("severity") == "CRITICAL"
    ])
    score = vuln_count * 10 + critical_count * 30
    return {
        "component": component["name"],
        "version": component.get("version", ""),
        "vulnerability_count": vuln_count,
        "critical_vulnerabilities": critical_count,
        "risk_score": min(score, 100),
        "risk_level": (
            "CRITICAL" if score >= 80 else
            "HIGH" if score >= 50 else
            "MEDIUM" if score >= 20 else "LOW"
        ),
    }
```

### Step 3: Vendor Risk Assessment

```python
def assess_vendor_risk(vendor: dict) -> dict:
    """Assess third-party vendor risk."""
    score = 0
    if not vendor.get("soc2_certified"):
        score += 20
    if vendor.get("data_access") == "sensitive":
        score += 25
    if vendor.get("admin_access"):
        score += 20
    if vendor.get("past_breaches", 0) > 0:
        score += 15 * vendor["past_breaches"]
    if not vendor.get("incident_response_plan"):
        score += 10

    return {
        "vendor": vendor["name"],
        "risk_score": min(score, 100),
        "risk_level": (
            "CRITICAL" if score >= 80 else
            "HIGH" if score >= 50 else
            "MEDIUM" if score >= 20 else "LOW"
        ),
        "gaps": [
            g for g in [
                "No SOC2" if not vendor.get("soc2_certified") else None,
                "Sensitive data access" if vendor.get("data_access") == "sensitive" else None,
                "Admin access" if vendor.get("admin_access") else None,
                "Past breaches" if vendor.get("past_breaches", 0) > 0 else None,
            ] if g
        ],
    }
```

## Detection

```yaml
title: Supply Chain Threat Intelligence Detection
id: 1de2dc6b-443c-4164-b994-0889d89e7349
status: experimental
description: Detects suspicious activity related to analyzing supply chain threat intelligence techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1195
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```

## Verification

- [ ] SBOM parsed and components matched against vulnerability databases
- [ ] Dependency risk scored combining vulnerability count and severity
- [ ] Vendor risk assessed across security posture dimensions
- [ ] Supply chain attack patterns mapped to ATT&CK T1195 sub-techniques
- [ ] Prioritized remediation list produced for high-risk dependencies
- [ ] Vendor risk scorecards generated with gap identification

## References

- [MITRE ATT&CK T1195](https://attack.mitre.org/techniques/T1195/)
- [OSV (Open Source Vulnerabilities)](https://osv.dev/)
- [CycloneDX SBOM Specification](https://cyclonedx.org/)
- [SPDX Specification](https://spdx.dev/)
- [NIST SP 800-161 Supply Chain Risk Management](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final)
