Suspicious Package Manager Activity Indicating Supply Chain Compromise
This rule detects suspicious activity related to package managers (nuget, dotnet) where an attempt is made to install or restore packages that are explicitly not marked as 'official' or 'trusted' and contain keywords like '-modified', '-patched', or '-update' in their URL. This could indicate an attempt to inject malicious or tampered dependencies into a project, a common technique in supply chain attacks. The rule triggers if two or more such events occur within an hour on the same computer by the same user.
Microsoft Sentinel (KQL)
