Supply Chain Attack Detection

Supply chain attack detection is the specific and largely underdeveloped capability to identify when the software build pipeline, artifact distribution infrastructure, or dependency supply chain has been compromised , as distinct from detecting attacks against production environments and end-user systems. Traditional security operations centres are optimised to detect production environment threats: network intrusion, endpoint compromise, credential abuse, and lateral movement in operational systems. They are rarely configured to ingest, correlate, or alert on supply chain-specific signals: unexpected changes to build pipeline configuration, anomalous artifact sizes for published versions, unexpected network calls from build agents, new maintainer accounts on critical dependencies, or signatures produced outside the expected build infrastructure.

The visibility gap is structural. Production security monitoring ingests logs and telemetry from production systems , servers, endpoints, network devices, cloud workloads , because production is where security teams have traditionally focused their monitoring investment. Build pipelines, CI/CD platforms, artifact registries, and dependency management infrastructure are typically owned by DevOps and engineering teams, operated as development infrastructure, and their logs are not routinely routed to the SOC. The signals that would reveal a build pipeline compromise , unexpected source code reads, anomalous artifact publishing accounts, build agent network calls to external infrastructure , exist in logs that are never consumed by security monitoring.

The dwell time problem quantifies the gap. The median dwell time for supply chain attacks , the period between initial compromise and discovery , is substantially longer than for production environment attacks, precisely because the detection infrastructure is absent. The SolarWinds attack dwelled for approximately fourteen months before discovery. The XZ Utils backdoor was active for approximately two months before a developer noticed an anomalous performance degradation. In both cases, the attack lived in the software supply chain , the build and distribution infrastructure , where traditional security monitoring was not looking.

Why this matters

Supply chain attack detection matters for TPRM because the vendor whose production security monitoring is excellent but whose build pipeline generates no SOC signals has a detection gap for exactly the attack vector that supply chain attacks use. Assessing a vendor's SOC maturity without assessing their supply chain-specific detection capability provides assurance about production security while leaving the supply chain attack surface unmonitored.

• SOC maturity assessed without supply chain detection scope
• Build pipeline logs not ingested by security monitoring
• Artifact registry access and publishing events not monitored
• Dependency change signals not integrated with threat intelligence
• Supply chain-specific detection rules absent from SIEM

What good looks like

Mature supply chain detection programmes extend security monitoring scope to include build pipeline activity logs, artifact registry access and publishing events, signing infrastructure usage, and dependency change signals , with specific detection logic for the anomalies that supply chain attacks produce: unexpected pipeline modifications, anomalous artifact publishing accounts, build agent external network calls, and dependency maintainer changes.

• Build pipeline log ingestion into SIEM or monitoring infrastructure
• Artifact registry access monitoring , unusual publishing accounts or volumes
• Signing infrastructure usage monitoring , unexpected signing events
• Dependency change alerting , new maintainer accounts on critical packages
• Supply chain-specific detection rules in SIEM for build anomalies

Tooling

Supply Chain Detection , Legit Security, Ox Security for software supply chain security posture and anomaly detection

Software supply chain security platforms provide the monitoring layer that traditional SOC tools do not cover , specifically ingesting build pipeline activity, repository configuration changes, artifact registry events, and dependency updates to identify anomalies. For TPRM practitioners, asking whether a vendor has deployed supply chain-specific monitoring that goes beyond production environment security monitoring provides a specific detection gap question.

SIEM Integration , GitHub Actions audit logs, GitLab CI/CD logs to SIEM; Sigstore transparency log monitoring

Build pipeline logs from major CI/CD platforms can be forwarded to SIEM platforms for correlation with other security signals. Sigstore's Rekor transparency log provides a tamper-evident record of signing events that can be monitored for anomalies , unexpected certificates, unexpected signing volumes, or signing events outside the expected build infrastructure timezone.

Governance challenges

The governance challenge with supply chain detection is the ownership question. Production security monitoring is the SOC's domain. Build pipeline monitoring is DevOps's domain. Supply chain detection sits in the gap between these two ownership territories. The governance resolution is explicit ownership assignment for supply chain detection , whether that is the SOC, a dedicated DevSecOps team, or a shared responsibility model with defined handoff points.

• Extend SOC ingestion to include build pipeline and registry logs
• Define supply chain detection rules for pipeline and registry anomalies
• Assign ownership for supply chain monitoring , SOC or DevSecOps
• Monitor Sigstore transparency log for signing anomalies
• Include supply chain detection scope in vendor SOC assessment

If you are a small team

Ask your critical software vendors the detection gap question directly: if an attacker compromised your build pipeline and began injecting code into artifacts, what monitoring would detect it and within what timeframe? That question reveals whether supply chain detection exists. A vendor who cannot point to specific monitoring for build pipeline anomalies , unexpected pipeline changes, anomalous artifact publishing, build agent external network calls , has the same detection gap that produced the eight-month dwell time in the hook.

• Ask vendors directly: what monitoring would detect a build pipeline compromise
• Ask about log ingestion scope , are build pipeline logs in the SOC's visibility
• Ask about artifact registry access monitoring
• Assess supply chain detection scope in vendor security assessment

What to require

Ask directly:

"If an attacker compromised your build pipeline and began injecting malicious code into your artifacts, what monitoring would detect it, where are those alerts routed, and what is your expected detection timeframe from compromise to alert?"

Expect as evidence

• Build pipeline monitoring scope and log ingestion
• Artifact registry access monitoring
• Supply chain-specific detection rules in SIEM
• Expected detection timeframe for build pipeline compromise

A vendor with excellent SOC coverage should be asked specifically whether that coverage includes build pipeline and artifact distribution monitoring. Production security monitoring and supply chain security monitoring are complementary but distinct capabilities. Eight months of dwell time in the build pipeline is consistent with excellent production monitoring and absent supply chain monitoring , simultaneously.

How to evidence it

• Supply chain detection scope assessment
• Build pipeline log ingestion records
• Supply chain-specific detection rules
• Expected detection timeframe for build compromise

Key Takeaway

SOC coverage: excellent. Endpoint detection: tuned. SIEM correlation: strong. Build pipeline: not monitored. Compromise: 8 months in the build infrastructure that the production monitoring never saw. Production security monitoring detects threats in production systems. Supply chain attacks live in the build and distribution infrastructure , upstream of the production perimeter that traditional monitoring protects. Build pipeline log ingestion, artifact registry access monitoring, and supply chain-specific detection rules extend the monitoring perimeter to include the attack surface that supply chain attackers specifically target.

More on Third-party oversight

• Build Pipeline Integrity
• Vendor Patch Cadence Reality
• Artifact Registry Security