Poisoned Pipeline / Mitigations / M1732
M1732
Implement code scanning for security risks
Scanning pull requests to detect risks allows for early detection of vulnerable code and/or dependencies and helps mitigate potentially malicious code.
For every repository in use, enforce risk scanning on every pull request.
Applies to
- T0196 Backdoor in code
- T0109 Publish malicious artifact
- T0104 Discover coding flaws
- T0102 Discover used open-source dependencies
- T0173 Auto merge rules in SCM
- T0132 Overprivileged CI/CD Runners
- T0164 Inject malicious dependency to privileged user repository
- T0115 Repojacking
- T0166 Trigger pipeline execution
- T0101 Discover technology stacks
- T0103 Scan public artifacts for secrets
- T0138 Backdoor in code
- T0170 Malicious compiler or interpreter
- T0110 Advertise malicious artifact
- T0107 Discover internal artifacts names
- T0121 Compromised legitimate artifact
- T0108 Accounts in public registry
- T0217 Build trusted artifacts from an attacker-controlled source
- T0181 Malicious module injection
- T0158 Vulnerable CI/CD template
- T0111 Malicious code contribution to an open-source repository