Supply Chain Compromise: Compromise Hardware Supply Chain
- ID
- T1195.003
- Tactics
- TA0001 Initial Access
- Sub-technique of
- T1195 Supply Chain Compromise
- Platforms
- Linux, macOS, Windows
- Data sources
- Host Status, File Metadata, Driver Load, Module Load, Process Access
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Detection
- DET0368 Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks
Data components: Host Status, File Metadata, Driver Load, Module Load, Process Access
Mitigations (1)
- M1046 Boot Integrity
Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised. Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification.[1][2]
References
- TCG Trusted Platform Module
- TechNet Secure Boot Process