- OSC&R :
- Open Software supply Chain attack Reference
[…] is an open framework that provides a comprehensive, systematic and actionable way to understand attacker behaviors and techniques.
Like MITRE ATT&CK, OSC&R is organized into a clear and structured view of the tactics, techniques, and procedures (TTPs) used by adversaries. However, OSC&R is the first and only matrix that focuses specifically on the software supply chain attacks. It covers a wide range of attack vectors, including vulnerabilities in third-party libraries and components, supply chain attacks on build and deployment systems, and compromised or malicious software updates.
https://pbom.dev/