Poisoned Pipeline / Mitigations / M1661
M1661
Revoke user permissions
Remove permissions granted on the SCM repository from users that do not need them.
Limit access to configuration files. Only grant access to users who need it to modify the configuration files.
Applies to
- T0199 Secret leak
- T0178 Deploy keys
- T0143 External user accounts
- T0166 Trigger pipeline execution
- T0186 Source code leak
- T0113 Compromised user account
- T0169 Push implants across repositories
- T0131 Overprivileged user account
- T0217 Build trusted artifacts from an attacker-controlled source
- T0114 Compromised service account
- T0182 Bypass review using admin permission