• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Potential Build Process Compromise

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•2•0•75

    'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process. More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'

    Microsoft Sentinel (KQL)

    Tags

    T1127.001 - MSBuildTA0002 - ExecutionT1612 - Build Image on HostT1222 - File and Directory Permissions ModificationT1195 - Supply Chain CompromiseT1195.003 - Compromise Hardware Supply ChainT1195.002 - Compromise Software Supply ChainT1027.016 - Junk Code InsertionT1593.003 - Code RepositoriesT1116 - Code SigningT1127.003 - JamPlusT1584.005 - BotnetT1583.005 - BotnetS0695 - DonutS0559 - SUNBURSTS0565 - RaindropS0560 - TEARDROPS0634 - EnvyScoutS0636 - VaporRageS0635 - BoomBoxTA0005 - Defense EvasionTA0001 - Initial AccessTA0043 - ReconnaissanceTA0042 - Resource DevelopmentProcess CreationFile ModificationWindowsWindows Eventlog SecuritykqlSolorigateNOBELIUMtactic:Persistencetechnique:T1554

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?