<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-supply-chain-attack-simulation
description: >-
  Simulate supply chain compromise scenarios including dependency poisoning,
  build pipeline hijacking, and trusted vendor impersonation to validate
  organizational resilience against upstream attack vectors.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - supply-chain
  - dependency-poisoning
  - build-pipeline
  - third-party-risk
  - software-integrity
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195", "T1195.001", "T1195.002", "T1199", "T1553.002"]
  frameworks: ["MITRE ATT&CK", "SLSA", "NIST SP 800-161"]
  tools: ["python3", "sigstore", "in-toto", "cosign"]
---

# Performing Supply Chain Attack Simulation

## Overview

Supply chain attack simulation replicates compromise scenarios targeting the
software supply chain — from dependency confusion and typosquatting to build
pipeline injection and signed artifact tampering. These simulations validate
whether software composition analysis, build integrity controls, and vendor
risk management detect upstream compromise before malicious code reaches
production environments.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `package manager CLIs` | Security tooling |
| `artifact signing tools` | Security tooling |
| Isolated build environment with no production connectivity | Environment requirement |
| Inventory of third-party dependencies and build pipelines | Environment requirement |
| Signed Rules of Engagement covering supply chain scope | Environment requirement |

## Workflow

### Step 1: Map Supply Chain Attack Surface

```bash
# Enumerate dependencies and build pipeline components
node scripts/agent.js enumerate --manifest package.json --pipeline ci.yml

# Identify high-risk dependency patterns
node scripts/agent.js analyze-deps --manifest requirements.txt
```

### Step 2: Simulate Dependency Confusion

```bash
# Create benign proof-of-concept package for dependency confusion
node scripts/agent.js dep-confusion --package internal-utils --registry pypi

# Simulate typosquatting detection test
node scripts/agent.js typosquat-check --manifest package.json
```

### Step 3: Test Build Pipeline Integrity

```bash
# Verify build artifact signing and provenance
node scripts/agent.js verify-provenance --artifact build.tar.gz --attestation att.json

# Simulate pipeline injection scenario
node scripts/agent.js pipeline-inject --pipeline .github/workflows/build.yml --dry-run
```

### Step 4: Generate Supply Chain Risk Report

```bash
# Produce supply chain risk assessment
node scripts/agent.js report --scope full --output supply-chain-report.json
```

## Detection

```yaml
title: Supply Chain Attack Simulation Detection
id: 8f5e2337-c356-417c-a189-a3dda5e7cdf6
status: experimental
description: Detects suspicious activity related to performing supply chain attack simulation techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*supply*"
  condition: selection
level: high
tags:
  - attack.t1195
  - attack.t1195.001
  - attack.t1195.002
  - attack.t1199
  - attack.t1553.002
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Supply Chain Attack Simulation Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1195, T1195.001, T1195.002, T1199, T1553.002 |

## Verification

- [ ] Dependency inventory complete with risk scoring
- [ ] Dependency confusion scenario tested against internal registries
- [ ] Build pipeline integrity controls validated
- [ ] Artifact signing and provenance verification tested
- [ ] Gap analysis identifies missing supply chain controls

## References

- [SLSA Framework](https://slsa.dev/) — Supply chain Levels for Software Artifacts
- [NIST SP 800-161](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final) — Supply chain risk management
