Supply Chain Compromise: Vendor Agent Spawning Suspicious Shell (T1195.002)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.