Poisoned Pipeline / Mitigations / M1590
M1590
Implement artifact signing and verification
Implementing artifact signing and verification can help prevent malicious actors from injecting or modifying software components with malicious code in the software supply chain.
Only components that are signed and verified are allowed to proceed to the next stage of the CI/CD process, ensuring that only trusted components are used in the development and delivery of software applications.
Applies to
- T0159 Malicious artifact execution
- T0215 Enroll attacker-owned code-signing identity
- T0157 Combosquatting
- T0170 Malicious compiler or interpreter