T1195.002 Compromise Software Supply Chain: Malicious Google Tag Manager Container

Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site. The container holds exactly one tag, a Custom HTML tag containing an obfuscated EtherHiding loader, fired on gtm.init, with no legitimate tags present, indicating a container created solely for delivery rather than a legitimate container that was tampered with. It is served from googletagmanager.com over TLS with a valid certificate, so host reputation, domain-age and TLS inspection all return clean; the malicious element is the container identifier, not the origin. This is the detection lesson worth generalizing: an allowlisted vendor domain is not an integrity signal when the vendor hosts arbitrary customer-supplied JavaScript. The durable form of this rule inverts the logic, alert on any gtm.js container ID retrieved by your properties that is absent from an approved-container watchlist, which requires an out-of-band list and is left to the deploying team. The single-ID form here is campaign-scoped and will age out when the operator rotates containers.

Intel context

The technique this rule covers is in use. This is the evidence for it as of November 7, 2026.

Technique	KEV CVEs	Research, 90d	Active families
T1195.002 Compromise Software Supply Chain	2	2	—

KEV CVEs mapped to this technique

CVEs in CISA KEV that MITRE maps to this technique. They may belong to other campaigns. They show the technique is in use.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2021-44529	Ivanti / Endpoint Manager Cloud Service Appliance (EPM CSA)	0.991	ransomware
CVE-2024-4978	Justice AV Solutions / Viewer	0.269	—

Research citing this technique

2026-11-06 · Socket Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools
2026-10-15 · Google Threat Intelligence Investigating Ephemeral Supply Chain Tampering

Rule ID: d4f129e9-8a67-5d74-9214-10a129ba7ffa
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-08-11
Modified: 2026-08-11
ATT&CK: T1195.002 (signal rollup)
Canonical YAML: t1195-002-unapproved-gtm-container-injection.yml

References

False positives

Security research, sandbox detonation, or threat-intel enrichment infrastructure deliberately retrieving the container for analysis.
Cached or replayed proxy traffic during incident reconstruction, which can re-surface the indicator after remediation is complete.

Rule YAML

title: 'T1195.002 Compromise Software Supply Chain: Malicious Google Tag Manager Container'
id: 'd4f129e9-8a67-5d74-9214-10a129ba7ffa'
status: 'experimental'
description: 'Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site. The container holds exactly one tag, a Custom HTML tag containing an obfuscated EtherHiding loader, fired on gtm.init, with no legitimate tags present, indicating a container created solely for delivery rather than a legitimate container that was tampered with. It is served from googletagmanager.com over TLS with a valid certificate, so host reputation, domain-age and TLS inspection all return clean; the malicious element is the container identifier, not the origin. This is the detection lesson worth generalizing: an allowlisted vendor domain is not an integrity signal when the vendor hosts arbitrary customer-supplied JavaScript. The durable form of this rule inverts the logic, alert on any gtm.js container ID retrieved by your properties that is absent from an approved-container watchlist, which requires an out-of-band list and is left to the deploying team. The single-ID form here is campaign-scoped and will age out when the operator rotates containers.'
references:
    - 'https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml'
    - 'https://attack.mitre.org/techniques/T1195/002/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.initial_access'
    - 'attack.t1195.002'
    - 'attack.resource_development'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_gtm_host:
        cs-host|endswith: 'googletagmanager.com'
    selection_container_id:
        c-uri|contains: 'GTM-PJB7D937'
    condition: 'selection_gtm_host and selection_container_id'
falsepositives:
    - 'Security research, sandbox detonation, or threat-intel enrichment infrastructure deliberately retrieving the container for analysis.'
    - 'Cached or replayed proxy traffic during incident reconstruction, which can re-surface the indicator after remediation is complete.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1195-002-unapproved-gtm-container-injection.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.