T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container

Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site. The container holds exactly one tag — a Custom HTML tag containing an obfuscated EtherHiding loader — fired on gtm.init, with no legitimate tags present, indicating a container created solely for delivery rather than a legitimate container that was tampered with. It is served from googletagmanager.com over TLS with a valid certificate, so host reputation, domain-age and TLS inspection all return clean; the malicious element is the container identifier, not the origin. This is the detection lesson worth generalizing: an allowlisted vendor domain is not an integrity signal when the vendor hosts arbitrary customer-supplied JavaScript. The durable form of this rule inverts the logic — alert on any gtm.js container ID retrieved by your properties that is absent from an approved-container watchlist — which requires an out-of-band list and is left to the deploying team. The single-ID form here is campaign-scoped and will age out when the operator rotates containers.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK technique is exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1195.002 Compromise Software Supply Chain	2	0	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2021-44529	Ivanti / Endpoint Manager Cloud Service Appliance (EPM CSA)	0.991	ransomware
CVE-2024-4978	Justice AV Solutions / Viewer	0.269	—

Rule ID: d4f129e9-8a67-5d74-9214-10a129ba7ffa
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-08-11
Modified: 2026-08-11
ATT&CK: T1195.002 (signal rollup)
Canonical YAML: t1195-002-unapproved-gtm-container-injection.yml

References

False positives

Security research, sandbox detonation, or threat-intel enrichment infrastructure deliberately retrieving the container for analysis.
Cached or replayed proxy traffic during incident reconstruction, which can re-surface the indicator after remediation is complete.

Rule YAML

title: 'T1195.002 Compromise Software Supply Chain — Malicious Google Tag Manager Container'
id: 'd4f129e9-8a67-5d74-9214-10a129ba7ffa'
status: 'experimental'
description: 'Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site. The container holds exactly one tag — a Custom HTML tag containing an obfuscated EtherHiding loader — fired on gtm.init, with no legitimate tags present, indicating a container created solely for delivery rather than a legitimate container that was tampered with. It is served from googletagmanager.com over TLS with a valid certificate, so host reputation, domain-age and TLS inspection all return clean; the malicious element is the container identifier, not the origin. This is the detection lesson worth generalizing: an allowlisted vendor domain is not an integrity signal when the vendor hosts arbitrary customer-supplied JavaScript. The durable form of this rule inverts the logic — alert on any gtm.js container ID retrieved by your properties that is absent from an approved-container watchlist — which requires an out-of-band list and is left to the deploying team. The single-ID form here is campaign-scoped and will age out when the operator rotates containers.'
references:
    - 'https://thrunt.me/sigma/t1195-002-unapproved-gtm-container-injection.yml'
    - 'https://attack.mitre.org/techniques/T1195/002/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.initial_access'
    - 'attack.t1195.002'
    - 'attack.resource_development'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_gtm_host:
        cs-host|endswith: 'googletagmanager.com'
    selection_container_id:
        c-uri|contains: 'GTM-PJB7D937'
    condition: 'selection_gtm_host and selection_container_id'
falsepositives:
    - 'Security research, sandbox detonation, or threat-intel enrichment infrastructure deliberately retrieving the container for analysis.'
    - 'Cached or replayed proxy traffic during incident reconstruction, which can re-surface the indicator after remediation is complete.'
level: 'high'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1195-002-unapproved-gtm-container-injection.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.