Software supply chain. Trojanized software update (SolarWinds/SUNBURST, CCleaner, M.E.Doc/NotPetya, 3CX). The vendor's build pipeline was compromised and a backdoor was injected into a signed, legitimate update distributed to all customers. The attacker inherits the vendor's trust.

SaaS/OAuth supply chain. A SaaS vendor you've integrated via OAuth is compromised, or a malicious OAuth app was consented by a user and now has persistent API access to your data. The attacker doesn't need your credentials: they have an authorized API token.

MSP/IT service provider. Your managed service provider is compromised. They have admin credentials to your environment, VPN access, RMM agent deployment rights, and often domain admin equivalent access. One compromised MSP can cascade to hundreds of downstream clients simultaneously.

Open-source dependency. A malicious package injected into npm, PyPI, or another registry, or a legitimate package maintainer's account was hijacked. The malicious code runs in your CI/CD pipeline or developer workstation when the dependency is installed or updated.

1. 1. Determine the scope of the compromised product/vendor in your environment How many hosts run the affected software? Which version? Is auto-update enabled? For SaaS: which users have accounts, what permissions does the integration have, what data does it access? For MSPs: what credentials and access do they hold? Build the complete map of your exposure to the compromised vendor before investigating individual hosts.
2. 2. Check whether the compromised version was deployed Cross-reference the compromised version (hash, version number, build date) against your software inventory. SolarWinds affected a specific Orion build range. CCleaner affected specific versions. If you have a version outside the affected range, you may not be compromised, but verify: check software update logs for any temporary installation of the affected version, even if it was later updated past the affected range. Software inventory / CMDB · Patch management logs
3. 3. Check for indicators of second-stage activation Most supply chain compromises are selective. SolarWinds SUNBURST backdoored 18,000 organizations but only ~100 received second-stage payloads (TEARDROP, Raindrop). The backdoor phones home with system info, and the attacker decides whether to escalate. Check for: C2 callbacks from the compromised software, second-stage payload delivery, and behavioral anomalies from the software process. NET: C2 · DNS logs for C2 domain lookups · Proxy logs for callbacks
4. 4. Review OAuth and API integrations with the compromised vendor For SaaS compromises: what API permissions does the vendor's integration have in your environment? Check for: OAuth tokens with Mail.Read, Files.ReadWrite, or directory scopes granted to the vendor's app. A compromised vendor with API access to your M365 tenant can read your email without touching your network. Revoke the tokens and review access logs. BEC playbook · APT29 OAuth abuse
5. 5. Audit MSP/vendor admin credentials and access logs For MSP compromise: immediately reset all credentials the MSP holds. Review their access logs: when did they log in, from where, what did they do? Check for: MSP admin accounts used at unusual times, RMM tools pushing unexpected scripts or payloads, and MSP VPN connections from unusual source IPs. The MSP's compromised credentials are your compromised credentials. Compromised Credentials playbook
6. 6. Check for lateral movement from the compromised software's host If the compromised software ran with elevated privileges (as most enterprise management tools do), check for: credential access from that host (LSASS dumps, SAM extraction), lateral movement originating from that host (SMB, RDP, WMI to other hosts), and discovery commands run by the software's process or its child processes. HOST: Lateral Movement · HOST: Credential Access
7. 7. Inspect open-source dependencies in CI/CD For package registry compromises: audit your lock files (package-lock.json, Pipfile.lock, Gemfile.lock) for the compromised package version. Check CI/CD build logs for: unexpected post-install scripts, network connections during build, and new files created outside the expected build output. Run npm audit, pip audit, or equivalent. Lazarus npm/PyPI supply chain · CI/CD audit logs
8. 8. Assess data exposure What data did the compromised vendor/software have access to? The SolarWinds Orion agent had network monitoring access to every device it managed. An MSP's RMM agent has SYSTEM-level access on every managed endpoint. A SaaS integration with Mail.Read has every email in the connected mailboxes. Scope the data exposure based on the permissions the compromised component held.
9. 9. Determine whether your environment was selected for follow-on Supply chain attacks are often broad access with selective exploitation. Indicators that you WERE selected: second-stage payloads deployed, C2 callbacks from the compromised software, credential access or lateral movement from the software's host, or data exfiltration. Indicators you were NOT selected: compromised version was installed but only made baseline telemetry callbacks (standard software behavior), no second-stage, no unusual activity.
10. 10. Coordinate with the vendor, peers, and sector ISAC The vendor may have IOCs, affected version details, and remediation guidance. Your sector ISAC may have reports from peer organizations. CISA may have a dedicated advisory. Supply chain incidents are inherently multi-organization events. Information sharing is not optional: your peer's findings inform your investigation and vice versa.

APT29 (SolarWinds SUNBURST, the defining supply chain attack), APT41 (CCleaner, ShadowPad in NetSarang, same-day Log4Shell), Sandworm (M.E.Doc/NotPetya, destructive supply chain), Lazarus (npm/PyPI package poisoning, trojanized cryptocurrency apps).

C2 Beacon Found (supply chain backdoors establish C2 as their first action)
Compromised Credentials (MSP credentials are your credentials)
Edge Device Compromised (firmware supply chain and vendor update integrity)
APT29 (SolarWinds methodology and selective second-stage activation)