Poisoned Pipeline / Mitigations / M1660
M1660
Isolate pipeline for unreviewed code
Ensure that pipelines running unreviewed code are executed on isolated nodes, not exposed to secrets and sensitive environments.
For sensitive pipelines, for example those that are exposed to secrets, ensure that each branch that is configured to trigger a pipeline in the CI system has a correlating branch protection rule in the SCM.
Each pipeline should only have access to the credentials it needs to fulfill its purpose. The credentials should have the minimum required privileges.
Applies to
- T0159 Malicious artifact execution
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
- T0211 Abuse registry-adjacent builders as remote execution
- T0166 Trigger pipeline execution