Poisoned Pipeline / Mitigations / M1500
M1500
Verify third-party artifacts and open-source libraries
Verify third-party artifacts used in code are trusted and have not been infected by a malicious actor before use.
This can be accomplished, for example, by comparing the checksum of the dependency to its checksum in a trusted source.
If a difference arises, this may be a sign that someone interfered and added malicious code.
If this dependency is used, it will infect the environment and could end in a massive breach, leaving the organization exposed to data leaks and more.
Applies to
- T0152 IDE
- T0129 Typosquatting
- T0215 Enroll attacker-owned code-signing identity
- T0102 Discover used open-source dependencies
- T0211 Abuse registry-adjacent builders as remote execution
- T0120 Dependency confusion
- T0164 Inject malicious dependency to privileged user repository
- T0157 Combosquatting
- T0151 Installation scripts
- T0172 Runtime backdoor
- T0194 Outdated software components
- T0170 Malicious compiler or interpreter
- T0110 Advertise malicious artifact
- T0150 Runtime logic bomb
- T0121 Compromised legitimate artifact
- T0108 Accounts in public registry
- T0217 Build trusted artifacts from an attacker-controlled source
- T0191 Malicious code in artifacts
- T0136 Brandjacking