TeamPCP Supply Chain Attack on Checkmarx Jenkins AST Plugin — Detection and Remediation Guide

---
title: Checkmarx Jenkins AST Plugin Compromised Version Installation
id: 8d2f4a1c-9e7b-4c3d-a1f5-6e8g9h0i1j2k
status: experimental
description: Detects installation of compromised Checkmarx Jenkins AST plugin versions after December 17, 2025
references:
 - https://thehackernews.com/2026/05/teampcp-compromises-checkmarx-jenkins.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.initial_access
 - attack.supply_chain
 - attack.t1195.002
logsource:
 category: file_change
 product: windows
detection:
 selection:
  TargetFilename|contains: '\plugins\checkmarx-ast'
  TargetFilename|endswith: '.jpi'
 condition: selection
 timeframe: 7d
falsepositives:
 - Legitimate plugin updates prior to compromise
level: critical
---
title: Jenkins Process Spawning Shell with Checkmarx Plugin Context
id: 9e3g5b2d-0f8c-4a1e-b2g6-7f9h0i1j2k3l
status: experimental
description: Detects Jenkins (java.exe) spawning suspicious shell processes potentially related to compromised AST plugin
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
  ParentImage|endswith: '\java.exe'
  ParentCommandLine|contains: 'jenkins'
 selection_child:
  Image|endswith:
   - '\cmd.exe'
   - '\powershell.exe'
   - '\bash.exe'
  CommandLine|contains:
   - 'download'
   - 'Invoke-WebRequest'
   - 'curl'
   - 'wget'
 condition: all of selection_*
falsepositives:
 - Legitimate build scripts executing shell commands
level: high
---
title: Jenkins Plugin Directory Modification - Suspicious Pattern
id: 0a4h6c3e-1g9d-5b2f-c3h7-0i1j2k3l4m5n
status: experimental
description: Detects modification of Jenkins plugin directory structures potentially indicating plugin tampering
references:
 - https://attack.mitre.org/techniques/T1565.001/
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.defense_evasion
 - attack.t1565.001
logsource:
 category: file_change
 product: windows
detection:
 selection:
  TargetFilename|contains:
   - '\plugins\checkmarx'
   - '\plugins\ast'
  Operation|contains:
   - 'FileModified'
   - 'FileRenamed'
 filter:
  User|contains:
   - 'SYSTEM'
   - 'JENKINS_SERVICE'
 condition: selection and not filter
falsepositives:
 - Authorized plugin management activities
level: medium

// Hunt for Checkmarx Jenkins AST plugin installation activity
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessVersionInfoOriginalFileName == "jenkins.war" or ProcessCommandLine contains "jenkins"
| where ProcessCommandLine contains "checkmarx" 
   or ProcessCommandLine contains "AST"
   or ProcessCommandLine contains "plugin"
| where ProcessCommandLine contains "install"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Check for suspicious network connections from Jenkins hosts
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "java.exe"
| where InitiatingProcessCommandLine contains "jenkins"
| where RemoteUrl contains "checkmarx" or RemotePort in (443, 8080, 80)
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteUrl, RemoteIP
| where Count > 10  // High volume connections may indicate data exfil
| order by Count desc

// File system modifications in Jenkins plugins directory
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath contains @"\plugins\checkmarx" 
   or FolderPath contains @"\plugins\ast"
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, FileName, SHA256
| order by Timestamp desc

-- Hunt for Checkmarx AST plugin versions in Jenkins directory
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/*jenkins*/plugins/checkmarx*/**')
WHERE Mtime > timestamp("2025-12-17")

-- Check for running Jenkins processes with suspicious children
SELECT Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCommandLine,
       Child.Pid AS ChildPid, Child.Name AS ChildName, Child.CommandLine AS ChildCommandLine
FROM pslist()
LEFT JOIN pslist() AS Child ON Parent.Pid = Child.Ppid
WHERE Parent.Name =~ "java" AND Parent.CommandLine =~ "jenkins"
  AND Child.Name IN ("cmd.exe", "powershell.exe", "bash.exe", "sh")
  AND Child.CommandLine =~ "(download|curl|wget|Invoke-WebRequest|netcat|nc)"

-- Identify network connections from Jenkins processes
SELECT Pid, Name, CommandLine, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ "java" AND CommandLine =~ "jenkins"
  AND RemotePort NOT IN (22, 80, 443, 8080, 50000)  // Non-standard Jenkins ports

#!/bin/bash

# Checkmarx Jenkins AST Plugin Remediation Script
# Usage: Run as root or Jenkins service user

JENKINS_HOME="/var/lib/jenkins"
PLUGIN_DIR="${JENKINS_HOME}/plugins"
SAFE_VERSION="2.0.13-829.vc72453fa_1c16"
LOG_FILE="/var/log/jenkins_plugin_remediation.log"

echo "[$(date)] Starting Checkmarx AST plugin remediation" >> "${LOG_FILE}"

# Backup current plugin state before remediation
BACKUP_DIR="/tmp/jenkins_plugin_backup_$(date +%Y%m%d_%H%M%S)"
mkdir -p "${BACKUP_DIR}"

echo "[$(date)] Creating backup of current plugin files" >> "${LOG_FILE}"
if [ -d "${PLUGIN_DIR}" ]; then
    find "${PLUGIN_DIR}" -name "checkmarx*.jpi" -o -name "checkmarx*.hpi" | while read plugin; do
        cp -p "${plugin}" "${BACKUP_DIR}/"
        echo "[$(date)] Backed up: ${plugin}" >> "${LOG_FILE}"
    done
fi

# Check installed Checkmarx AST plugin version
echo "[$(date)] Checking installed Checkmarx AST plugin version" >> "${LOG_FILE}"
INSTALLED_VERSION=$(find "${PLUGIN_DIR}" -name "checkmarx*.jpi" -o -name "checkmarx*.hpi" 2>/dev/null | head -1)

if [ -n "${INSTALLED_VERSION}" ]; then
    # Extract version from MANIFEST.MF if available
    PLUGIN_VERSION=$(unzip -p "${INSTALLED_VERSION}" META-INF/MANIFEST.MF 2>/dev/null | grep "Plugin-Version" | cut -d: -f2 | tr -d ' \r')
    echo "[$(date)] Found installed version: ${PLUGIN_VERSION}" >> "${LOG_FILE}"
    
    if [ "${PLUGIN_VERSION}" == "${SAFE_VERSION}" ] || [ -z "${PLUGIN_VERSION}" ]; then
        echo "[$(date)] Version ${PLUGIN_VERSION} appears safe or could not be determined. Manual verification required." >> "${LOG_FILE}"
    else
        echo "[!] ALERT: Potentially compromised version detected: ${PLUGIN_VERSION}" >> "${LOG_FILE}"
        echo "[!] Removing plugin file: ${INSTALLED_VERSION}" >> "${LOG_FILE}"
        rm -f "${INSTALLED_VERSION}"
    fi
else
    echo "[$(date)] No Checkmarx AST plugin found in plugin directory" >> "${LOG_FILE}"
fi

# Check for any additional suspicious files in Checkmarx plugin directory
echo "[$(date)] Scanning for suspicious artifacts" >> "${LOG_FILE}"
find "${PLUGIN_DIR}" -path "*checkmarx*" -type f \( -name "*.class" -o -name "*.jar" \) -newermt "2025-12-17" >> "${LOG_FILE}" 2>&1

# Restart Jenkins service to apply changes if plugin was removed
if [ -f "${INSTALLED_VERSION}" ] && [ "${PLUGIN_VERSION}" != "${SAFE_VERSION}" ]; then
    echo "[$(date)] Compromised plugin removed. Restarting Jenkins service." >> "${LOG_FILE}"
    systemctl restart jenkins
    echo "[$(date)] Jenkins restart initiated" >> "${LOG_FILE}"
fi

echo "[$(date)] Remediation script completed. Review log at: ${LOG_FILE}" >> "${LOG_FILE}"
echo "Backup location: ${BACKUP_DIR}"