title: 'T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container'
id: 'd4f129e9-8a67-5d74-9214-10a129ba7ffa'
status: 'experimental'
description: 'Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site. The container holds exactly one tag — a Custom HTML tag containing an obfuscated EtherHiding loader — fired on gtm.init, with no legitimate tags present, indicating a container created solely for delivery rather than a legitimate container that was tampered with. It is served from googletagmanager.com over TLS with a valid certificate, so host reputation, domain-age and TLS inspection all return clean; the malicious element is the container identifier, not the origin. This is the detection lesson worth generalizing: an allowlisted vendor domain is not an integrity signal when the vendor hosts arbitrary customer-supplied JavaScript. The durable form of this rule inverts the logic — alert on any gtm.js container ID retrieved by your properties that is absent from an approved-container watchlist — which requires an out-of-band list and is left to the deploying team. The single-ID form here is campaign-scoped and will age out when the operator rotates containers.'
references:
    - 'https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml'
    - 'https://attack.mitre.org/techniques/T1195/002/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.initial_access'
    - 'attack.t1195.002'
    - 'attack.resource_development'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_gtm_host:
        cs-host|endswith: 'googletagmanager.com'
    selection_container_id:
        c-uri|contains: 'GTM-PJB7D937'
    condition: 'selection_gtm_host and selection_container_id'
falsepositives:
    - 'Security research, sandbox detonation, or threat-intel enrichment infrastructure deliberately retrieving the container for analysis.'
    - 'Cached or replayed proxy traffic during incident reconstruction, which can re-surface the indicator after remediation is complete.'
level: 'high'