Poisoned Pipeline / Mitigations / M1662
M1662
Evaluate pipeline execution permissions
Evaluate the need for triggering pipelines on public repositories from external contributors.
Where possible, refrain from running pipelines originating from forks, and consider adding controls such as requiring manual approval for pipeline execution.
Applies to
- T0159 Malicious artifact execution
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
- T0166 Trigger pipeline execution
- T0217 Build trusted artifacts from an attacker-controlled source
- T0182 Bypass review using admin permission