<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-supply-chain-container-attacks
description: >-
  Detect supply chain attacks targeting container images including typosquatting,
  base image compromise, dependency confusion, malicious layers, and CI/CD
  pipeline poisoning using SBOM analysis and provenance verification.
domain: cybersecurity
subdomain: container-security
tags:
  - supply-chain
  - sbom
  - slsa
  - provenance
  - typosquatting
  - dependency-confusion
  - base-image
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Supply Chain Container Attacks

## Overview

Supply chain attacks target the build and distribution pipeline rather than the
running application. This skill covers verifying base image provenance with
Cosign and SLSA attestations, SBOM diff analysis to detect unexpected dependency
changes, typosquatting detection, malicious layer inspection, and CI/CD pipeline
integrity through pinned actions and reproducible builds.

Mode: `[MODE: BLUE]` — Defensive supply chain analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Trivy >= 0.50 for vulnerability and SBOM scanning | Required |
| Cosign >= 2.2 for provenance verification | Required |
| Syft >= 1.0 for SBOM generation | Required |
| SLSA Verifier for provenance attestation | Required |

## Key Concepts

### Base Image Provenance

```bash
# Verify base image signature
cosign verify --certificate-identity "keyless@distroless.iam.gserviceaccount.com" \
  --certificate-oidc-issuer "https://accounts.google.com" \
  gcr.io/distroless/static:nonroot

# Verify SLSA provenance
slsa-verifier verify-image registry.example.com/app:v1.0 \
  --source-uri github.com/org/repo
```

### SBOM Diff Analysis

```bash
# Generate SBOMs for comparison
syft registry.example.com/app:v1.0 -o spdx-json > sbom_v1.0.json
syft registry.example.com/app:v1.1 -o spdx-json > sbom_v1.1.json

# Compare for unexpected changes
diff <(jq -r '.packages[].name' sbom_v1.0.json | sort) \
     <(jq -r '.packages[].name' sbom_v1.1.json | sort)
```

### Layer Analysis for Malicious Content

```bash
# Extract and inspect layers
docker save target:latest | tar -xf - -C /tmp/image_layers/

# Check each layer
for manifest in /tmp/image_layers/*/layer.tar; do
  tar -tf "$manifest" 2>/dev/null | grep -iE \
    '\.sh$|cron|authorized_keys|shadow|reverse|shell|miner|backdoor'
done

# Check history for suspicious commands
docker history --no-trunc target:latest | grep -iE \
  'curl.*\|.*sh|wget.*\|.*bash|nc |ncat '
```

### CI/CD Pipeline Integrity

```yaml
# Pin actions by SHA, not tag
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

# Generate SLSA provenance
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
```

## Workflow

### Step 1: Verify Image Provenance

```bash
node scripts/agent.js --verify-provenance --image app:v1.0 --output /tmp/provenance.json
```

### Step 2: SBOM Diff Between Versions

```bash
node scripts/agent.js --sbom-diff --old v1.0 --new v1.1 --output /tmp/sbom-diff.json
```

### Step 3: Scan Layers for Malicious Content

```bash
node scripts/agent.js --scan-layers --image app:v1.1 --output /tmp/layer-scan.json
```

## Detection

```yaml
title: Supply Chain Container Attacks Detection
id: 28a583a2-d959-4601-96f9-7d807cb8e246
status: experimental
description: Detects suspicious activity related to detecting supply chain container attacks techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Supply Chain Container Attacks Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] Base images verified with Cosign signatures
- [ ] SLSA provenance attestations present on all release images
- [ ] SBOM diff shows no unexpected new dependencies
- [ ] Image layers contain no suspicious files or scripts
- [ ] CI/CD actions pinned by SHA, not mutable tag
- [ ] Docker history shows no suspicious download-and-execute patterns

## References

- [SLSA Framework](https://slsa.dev/)
- [Sigstore — Software Supply Chain Security](https://www.sigstore.dev/)
- [NIST SP 800-218 — SSDF](https://csrc.nist.gov/publications/detail/sp/800-218/final)
- [CNCF Supply Chain Security Best Practices](https://github.com/cncf/tag-security/tree/main/supply-chain-security)
- [MITRE ATT&CK T1195.002 — Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/002/)
