Rust Crates.io Supply Chain Attack: Malicious arrayref, internment & append-only-vec Builds Execute Remote Payloads — Detection and Remediation Guide

---
title: Cargo Build Process Spawning Network or Scripting Tools
description: Detects cargo, rustc, or cargo build scripts spawning network utilities or script interpreters, consistent with a malicious build.rs downloading a remote payload as seen in the arrayref/internment/append-only-vec crates.io supply chain attack.
id: 4b7e2c91-6a3d-4f58-9c21-8e0b5d3a7f42
status: experimental
references:
  - https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cargo.exe'
      - '\rustc.exe'
      - '\rustup.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate crates with build scripts that shell out to system tools (cc, nasm, protoc wrappers) - baseline your build environment and tune per build host
level: high
---
title: Linux Cargo Build Spawning Download or Execution Chains
description: Detects cargo/rustc build scripts on Linux spawning downloaders or shells, matching the build-time remote payload retrieval technique used in the crates.io supply chain compromise of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9.
id: 9c1d5e84-2f7a-4b6c-a3d1-5e9f0b8c4d63
status: experimental
references:
  - https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html
  - https://attack.mitre.org/techniques/T1195/002/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/cargo'
      - '/rustc'
  selection_child:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Build scripts for crates with native dependencies frequently invoke sh/bash via cc-rs and pkg-config - restrict alerting to download/execution combinations on build hosts and tune per CI image
level: high
---
title: Build Process Network Egress to Non-Registry Destinations
description: Detects cargo or rustc processes initiating network connections to destinations outside known Rust package infrastructure (crates.io, static.crates.io, GitHub). Malicious build scripts in this campaign fetched second-stage payloads from attacker-controlled infrastructure during compilation.
id: 2f8a4d67-1c9e-4b35-8f02-7a6c1e5d9b84
status: experimental
references:
  - https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cargo.exe'
      - '\rustc.exe'
      - '\build-script-build.exe'
  filter_crates:
    DestinationHostname|endswith:
      - 'crates.io'
      - 'static.crates.io'
      - 'github.com'
      - 'githubusercontent.com'
      - 'githubassets.com'
  condition: selection and not filter_crates
falsepositives:
  - Builds using private registries, mirrors, or vendored git dependencies - add your internal registry domains to the filter
level: high

// Hunt 1: Cargo/rustc spawning downloaders or script interpreters (build-time payload retrieval)
// Covers developer workstations and CI runners onboarded to Defender for Endpoint
let BuildParents = dynamic(["cargo.exe", "rustc.exe", "cargo", "rustc", "build-script-build.exe", "build-script-build"]);
let SuspiciousChildren = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe",
                                  "mshta.exe", "rundll32.exe", "curl", "wget", "bash", "sh", "python", "python3", "perl", "nc", "ncat"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (BuildParents)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt 2: Network egress from build binaries to non-registry destinations
let RegistryHosts = dynamic(["crates.io", "static.crates.io", "index.crates.io", "github.com",
                             "raw.githubusercontent.com", "objects.githubusercontent.com", "codeload.github.com"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ (dynamic(["cargo.exe", "rustc.exe", "build-script-build.exe", "cargo", "rustc", "build-script-build"]))
| where not(RemoteUrl has_any (RegistryHosts))
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| sort by ConnectionCount desc;

// Hunt 3: Linux Syslog/Sysmon-for-Linux ingestion path — cargo spawning shells or downloaders
Syslog
| where TimeGenerated > ago(30d)
| where ProcessName in~ ("curl", "wget", "bash", "sh", "python3", "perl", "nc", "ncat")
| where SyslogMessage has_any ("cargo", "rustc", "build-script-build")
   or SyslogMessage has_any ("target/debug/build", "target/release/build")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc

-- Artifact: Hunt.CratesIO.BuildTimeExecution
-- Identify cargo/rustc build processes with suspicious child processes or
-- active network connections, plus locate affected crate versions in lockfiles.
-- Deploy as a hunt across developer workstations and CI/build hosts.

-- Section 1: Live processes - cargo/rustc lineage with network or script children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cargo|rustc|build-script-build)'
   OR CommandLine =~ '(?i)(curl|wget|powershell|certutil|bash|python).*(http|ftp)'

-- Section 2: Open network connections from build processes
SELECT Pid, Name, Pid as BuildPid, Status,
       "Laddr" as LocalAddr, "Lport" as LocalPort,
       "Raddr" as RemoteAddr, "Rport" as RemotePort
FROM netstat()
WHERE Name =~ '(?i)(cargo|rustc|build-script-build)'
  AND Status =~ 'ESTABLISHED'

-- Section 3: Sweep for poisoned crate versions in Cargo.lock files
-- Adjust roots per platform; container/CI images may need /home and /workspace
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath, length=200000) =~ '(?i)name = "(arrayref|internment|append-only-vec)"[^\[]*version = "(0\.3\.10|0\.8\.7|0\.1\.9)"' AS PoisonedVersionFound
FROM glob(globs=[
  'C:/Users/**/Cargo.lock',
  '/home/**/Cargo.lock',
  '/workspace/**/Cargo.lock',
  '/builds/**/Cargo.lock',
  '/root/**/Cargo.lock'
])
WHERE PoisonedVersionFound

#!/usr/bin/env bash
# cratesio-compromise-audit.sh
# Detects poisoned crate versions from the August 2026 crates.io supply chain attack
# (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) in lockfiles,
# cargo caches, and build artifacts. Read-only: performs no destructive actions.

set -u

POISONED='^(arrayref|internment|append-only-vec)$'
BADVER_ARRAYREF="0.3.10"
BADVER_INTERNMENT="0.8.7"
BADVER_APPENDONLYVEC="0.1.9"
FOUND=0
REPORT="cratesio-audit-$(hostname)-$(date +%Y%m%d%H%M%S).txt"

echo "=== crates.io supply chain exposure audit - $(date) ===" | tee "$REPORT"

# --- 1. Scan Cargo.lock files for the malicious versions ---
echo "[1] Scanning Cargo.lock files..." | tee -a "$REPORT"
while IFS= read -r lock; do
  hits=$(awk '/^name = /{n=$3} /^version = /{print n, $3}' "$lock" 2>/dev/null \
    | tr -d '"' \
    | awk -v a="$BADVER_ARRAYREF" -v i="$BADVER_INTERNMENT" -v v="$BADVER_APPENDONLYVEC" '
        ($1=="arrayref" && $2==a) || ($1=="internment" && $2==i) || ($1=="append-only-vec" && $2==v)')
  if [ -n "$hits" ]; then
    echo "  [EXPOSED] $lock contains: $hits" | tee -a "$REPORT"
    FOUND=1
  fi
done < <(find /home /root /workspace /builds /srv /opt -name Cargo.lock -type f 2>/dev/null)

# --- 2. Check cargo registry cache for downloaded poisoned crates ---
echo "[2] Checking local cargo registry caches..." | tee -a "$REPORT"
for d in "$HOME/.cargo/registry/cache" "$HOME/.cargo/registry/src" /usr/local/cargo/registry; do
  if [ -d "$d" ]; then
    hits=$(find "$d" \( -name 'arrayref-0.3.10*' -o -name 'internment-0.8.7*' -o -name 'append-only-vec-0.1.9*' \) 2>/dev/null)
    if [ -n "$hits" ]; then
      echo "  [EXPOSED] Cached malicious crate artifacts:" | tee -a "$REPORT"
      echo "$hits" | sed 's/^/    /' | tee -a "$REPORT"
      FOUND=1
    fi
  fi
done

# --- 3. Search build trees for build-script-build binaries from the exposure window ---
echo "[3] Checking target/ directories for recently compiled build scripts..." | tee -a "$REPORT"
find /home /root /workspace /builds -type f -name 'build-script-build' -mtime -45 2>/dev/null \
  | while read -r b; do echo "  [REVIEW] $b (verify crate provenance)" | tee -a "$REPORT"; done

# --- 4. Verdict ---
if [ "$FOUND" -eq 1 ]; then
  echo "" | tee -a "$REPORT"
  echo "RESULT: EXPOSURE FOUND. Treat host as potentially compromised:" | tee -a "$REPORT"
  echo "  1. Isolate the host from the network (do NOT power off)." | tee -a "$REPORT"
  echo "  2. Rotate all credentials reachable from this host: SSH keys, cloud tokens," | tee -a "$REPORT"
  echo "     registry tokens (crates.io, Docker, npm), CI secrets, signing keys." | tee -a "$REPORT"
  echo "  3. Preserve Cargo.lock, ~/.cargo, and target/ for forensics." | tee -a "$REPORT"
  echo "  4. Rebuild any artifacts produced during the exposure window from a clean host." | tee -a "$REPORT"
else
  echo "RESULT: No poisoned versions detected on this host." | tee -a "$REPORT"
fi
echo "Report saved to $REPORT"

# Windows equivalent - run elevated on developer workstations and self-hosted runners
$poisoned = @('arrayref-0.3.10', 'internment-0.8.7', 'append-only-vec-0.1.9')
$exposed = $false

# 1. Scan Cargo.lock files under user profiles and common build roots
$roots = @("$env:USERPROFILE", 'C:uilds', 'C:
unner', 'D:uilds') | Where-Object { Test-Path $_ }
Get-ChildItem -Path $roots -Filter Cargo.lock -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    if ($content -match 'name = "(arrayref)"
?
version = "0.3.10"' -or
        $content -match 'name = "(internment)"
?
version = "0.8.7"' -or
        $content -match 'name = "(append-only-vec)"
?
version = "0.1.9"') {
        Write-Warning "[EXPOSED] $($_.FullName)"
        $exposed = $true
    }
}

# 2. Check cargo caches for poisoned crate artifacts
$cargoCache = "$env:USERPROFILE\.cargo\registry"
if (Test-Path $cargoCache) {
    Get-ChildItem -Path $cargoCache -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $n = $_.Name; $poisoned | Where-Object { $n -like "$_*" } } |
        ForEach-Object { Write-Warning "[EXPOSED] Cached artifact: $($_.FullName)"; $exposed = $true }
}

# 3. Recent build-script-build.exe binaries (exposure window)
Get-ChildItem -Path $roots -Filter 'build-script-build.exe' -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) } |
    ForEach-Object { Write-Output "[REVIEW] $($_.FullName) - verify provenance" }

if ($exposed) {
    Write-Warning 'EXPOSURE CONFIRMED: isolate host, rotate all reachable credentials, preserve .cargo and target/ for forensics.'
} else {
    Write-Output 'No poisoned crate versions detected on this host.'
}