TeamPCP Trivy Supply Chain Compromise Indicators (CVE-2026-33634)

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•1•0•111

This detection rule identifies activities related to the TeamPCP Trivy supply chain compromise (CVE-2026-33634). It looks for specific indicators such as the presence of 'tpcp.tar.gz' in command lines, connections to the exfiltration domain 'scan.aquasecurtiy.org', access to '/proc/[pid]/mem' via command line, or the execution of 'sysmon.py' or 'systemctl' in suspicious contexts. A match indicates a strong reason for investigation, particularly in CI runner or developer environments, to confirm compromise and review follow-on activities.