Poisoned Pipeline / Origins
Where each technique came from
Every technique has an origin kind and at least one source URL. Techniques that started with no references now point at the ATT&CK, OWASP, SLSA, or research analog that justifies them.
Public incident / advisory (23)
T0100Discover naming conventionsTXTBOOK reconstructed Tinkoff/T-Bank private package namespaces; Birsan found internal names via public docs and DNS. Also plain OWASP recon guidance.T0101Discover technology stacksPolyfill.io attackers picked a JS library embedded across hundreds of thousands of sites; dependency-confusion operators profile target stacks. Also OWASP reconT0102Discover used open-source dependenciesBirsan dependency confusion and llms.txt unclaimed-package squatting both started by enumerating a target’s dependencies. Also OWASP guidance.T0104Discover coding flawsWiz chained three Artifactory vulnerabilities; Antrea and Nx incidents exploited known CI/CD flaws. Also GitHub secure-code guidance.T0143External user accountsAS20 (@7nohe) let any external commenter run the publish path; prt-scan and hackerbot-claw used throwaway external accounts. Also OWASP CICD-SEC-2.T0149Delete repositoriesDestructive npm packages and wget-to-wipeout Go modules deleted host codebases on remote trigger; SLSA models the same as an availability threat.T0159Malicious artifact executionTaken from a public incident, vendor advisory, or first-party write-up cited below.T0164Inject malicious dependency to privileged user repositoryarrayref/proc-macro1 injected a build-time dependency into privileged maintainer repos (arrayref in 35% of environments); OWASP CICD-SEC-3 names the pattern.T0165Create access tokenTaken from a public incident, vendor advisory, or first-party write-up cited below.T0190Weak encryptionVelora SDK beaconed over plain HTTP; SleeperGem fetched payloads with certificate verification off. Also OWASP weak-crypto guidance.T0199Secret leakTaken from a public incident, vendor advisory, or first-party write-up cited below.T0205Compromise third-party CDN or hosted web assetThis catalogue, after Polyfill.io (Sansec) showed CDN/web-asset takeover was unnamed. DEF CON 33: abandoned S3 buckets still referenced by software (Shudrak).T0208Compromise code-signing identityShadowHammer/CCleaner signed updates, DAEMON Tools signed binaries; conference: Black Hat USA 2026 briefings on hardware/UEFI (EL2 attack surface, USB wallet AIT0209Compromise package registry or CDN originCoder origin pool, corepack.org, Notepad++; DEF CON 34: “No Socket, No Privs, No Problem: Weaponizing OCI Registries for SSRF, Credential Theft, and Container ET0210Poison AI coding-agent config or workspaceHades, Claude Code hooks; DEF CON 34: “The Sandbox is a Suggestion”, “No Prompt Required: Pre-Task RCE in Google Gemini CLI”, “Hacking Your Life with AI”, “WresT0211Abuse registry-adjacent builders as remote executionThis catalogue, from GemStuffer / RubyDoc.info YARD --load (SafeDep, RubyHack, RubyGems).T0212Subvert network routing to intercept update trafficThis catalogue, from the Virtualizor/Softaculous BGP route hijack (BleepingComputer write-up; Softaculous confirmed and now signs all packages).T0213Orchestrate AI-agent fleet as the intrusion workforceThis catalogue, from CloudSEK's analysis of an exposed operator staging host revealing an autonomous AI-agent crypto-theft fleet (Claude Code, Codex, Hermes, piT0214Rent co-located containers to scan an isolated networkThis catalogue, from CloudSEK's analysis of a leaked offensive control panel (VHX Harvester) that rented containers beside vast.ai tenants on the same physical T0215Enroll attacker-owned code-signing identityThis catalogue, from the MacSync fake-installer wave (OSM verified report, initial intel Jamf Threat Labs) where every lure DMG was signed and notarized by the T0216Wipe developer profile if a stolen token is revokedThis catalogue, from StepSecurity's write-up of tensorlake@0.5.144. gh-token-monitor polls the stolen GitHub token and deletes the home directory or Windows useT0218Compromise TLS trust identityThis catalogue, from the eMudhra single-byte CA keys (Scott Helme, October 2026) where six TLS intermediates were recoverable in under a second. The historical T0219Exfiltrate secrets through the CI platform's own log storeThis catalogue, from the Gheist campaign (Wiz Research, 25 October 2026) where a planted sync-check workflow printed base32-encoded repository secrets into its
Security research (44)
T0103Scan public artifacts for secretsIdentified in published CI/CD or supply-chain security research cited below. DEF CON 32: CloudQuarry, secrets in 3.1 million public AMIs.T0105Active scanningIdentified in published CI/CD or supply-chain security research cited below.T0107Discover internal artifacts namesBirsan dependency confusion; TXTBOOK/T-Bank private namespace reconstruction; conference: Black Hat USA 2026 “Turning Enterprise Update Servers Into Backdoor FaT0108Accounts in public registryIdentified in published CI/CD or supply-chain security research cited below.T0109Publish malicious artifactIdentified in published CI/CD or supply-chain security research cited below.T0111Malicious code contribution to an open-source repositoryIdentified in published CI/CD or supply-chain security research cited below. DEF CON 32: XZ backdoor story (Roccia) — maintainer commits.T0113Compromised user accountIdentified in published CI/CD or supply-chain security research cited below.T0115RepojackingSecurity Innovation repo-jacking write-up; DEF CON 34: “Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks” (Silva) — same unclT0120Dependency confusionBirsan 2021; Google bin-entry harvesting, TXTBOOK, sl4x0 waves; conference: Black Hat USA 2026 “ThreatForest: Automated Attack Trees from Source Code” and “The T0121Compromised legitimate artifactIdentified in published CI/CD or supply-chain security research cited below. DEF CON 32: XZ backdoor story — backdoored liblzma release.T0122Vulnerability in third-party CI/CD actionstj-actions, Trivy Action tags, codfish floating tags; conference: Black Hat USA 2026 “GitHub Can Tell You’re Being Hacked. You’re Just Not Listening: Building ET0128Permissive network accessIdentified in published CI/CD or supply-chain security research cited below.T0129TyposquattingIdentified in published CI/CD or supply-chain security research cited below.T0130Harvest secrets from logsIdentified in published CI/CD or supply-chain security research cited below.T0131Overprivileged user accountIdentified in published CI/CD or supply-chain security research cited below.T0132Overprivileged CI/CD RunnersIdentified in published CI/CD or supply-chain security research cited below. DEF CON 32: Grand Theft Actions, self-hosted runners (Khan/Stawinski).T0133Vulnerable CICD pluginsIdentified in published CI/CD or supply-chain security research cited below.T0138Backdoor in codeIdentified in published CI/CD or supply-chain security research cited below.T0141Fake developer reputation (Starjacking)Identified in published CI/CD or supply-chain security research cited below.T0144Misconfigured traffic log settingsIdentified in published CI/CD or supply-chain security research cited below.T0146Misconfigured audit logs settingsIdentified in published CI/CD or supply-chain security research cited below.T0147Scan public CI/CD configurations for secrets and vulnerable actionsIdentified in published CI/CD or supply-chain security research cited below.T0148Scheduled tasks on self hosted runnerIdentified in published CI/CD or supply-chain security research cited below.T0151Installation scriptsIdentified in published CI/CD or supply-chain security research cited below.T0153Compromised developer workstationIdentified in published CI/CD or supply-chain security research cited below.T0154Malicious IDE extensionDarkGPT, Nx Console; DEF CON 34: “Install Me Maybe” (claimable extension IDs) and “LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails” (Donenfeld) exT0155Cloud workloadIdentified in published CI/CD or supply-chain security research cited below.T0156Exfiltration over webhooksIdentified in published CI/CD or supply-chain security research cited below.T0158Vulnerable CI/CD templateIdentified in published CI/CD or supply-chain security research cited below.T0162Passwords in CI/CD logsIdentified in published CI/CD or supply-chain security research cited below.T0166Trigger pipeline executionIdentified in published CI/CD or supply-chain security research cited below.T0169Push implants across repositoriesIdentified in published CI/CD or supply-chain security research cited below. DEF CON 31: GitHub Actions Worm spreads through the Actions dependency tree.T0170Malicious compiler or interpreterKen Thompson’s 1983 trusting-trust demo is the original; conference talks formalize compiler-level attacks: Black Hat USA 2026 “Burning Tears of PHP’s Memory HaT0172Runtime backdoorIdentified in published CI/CD or supply-chain security research cited below.T0179Exposed webHookIdentified in published CI/CD or supply-chain security research cited below.T0182Bypass review using admin permissionIdentified in published CI/CD or supply-chain security research cited below.T0183Harvesting short-lived tokenIdentified in published CI/CD or supply-chain security research cited below. DEF CON 32: OH-MY-DC, leaked CI OIDC token to cloud (Hahami).T0184Harvesting sensitive information from filesIdentified in published CI/CD or supply-chain security research cited below.T0185Steal credentials in container artifactsIdentified in published CI/CD or supply-chain security research cited below.T0186Source code leakIdentified in published CI/CD or supply-chain security research cited below.T0191Malicious code in artifactsIdentified in published CI/CD or supply-chain security research cited below.T0192Sensitive information in logsIdentified in published CI/CD or supply-chain security research cited below.T0194Outdated software componentsIdentified in published CI/CD or supply-chain security research cited below.T0196Backdoor in codeIdentified in published CI/CD or supply-chain security research cited below.
Standard or guidance (13)
T0112Compromised tokenRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0117SQL injectionRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0118Command injectionNx s1ngularity PR-title injection, Antrea Job DSL eval, prt-scan payloads; conference: Black Hat USA 2026 “GitHub Can Tell You’re Being Hacked” (Weinberger/WeizT0119Cross-site scriptingRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0123Exposed internal APIRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0124Unencrypted data at restRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0125Unencrypted data in transitRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0135Vulnerable CICD systemRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0188Cross Site Request ForgeryRecorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.T0202Inadequate CI/CD workflow permissionsThis catalogue, from upstream issue #42 and OWASP CICD-SEC-5 (pipeline-based access controls).T0203Discover localized out-of-band deploymentsThis catalogue, from upstream issue #23; cited OWASP Top 10 CI/CD.T0206Forge or omit build provenanceThis catalogue, from NIST SSDF PS.3.2 and SLSA build threats (forge/omit provenance).T0207Skip or forge artifact integrity verificationPolyfill.io SRI gap, fwupd CVE-2020-10759; DEF CON 34: “LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails” (Donenfeld) — model-based build gates as
ATT&CK / AppSec analog (3)
T0134Add userATT&CK T1136 Create Account, applied to CI/CD, SCM, and cloud. Original YAML had no URL.T0161Implant in zombie instanceCloud persistence analog of ATT&CK T1525 Implant Internal Image (backdoor on an instance that looks idle). Original YAML had no URL.T0168Exfiltration to code repositoriesAnalog of a well-known ATT&CK or AppSec technique, applied to software supply chain.
Security article (31)
T0106Scan configuration on public resourcesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0110Advertise malicious artifactInherited article citation; conference: DEF CON 34 “Hacking the Hackers who Hack Hackers” (Morag) — FirewallFalcon is promoted on Telegram as a legitimate open-T0114Compromised service accountCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0116Shadow ITCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0126Exposed storageCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0127Exposed databaseCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0136BrandjackingCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0137Weak authentication methodsCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0139Resource hijackingCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0140Harvest tokens from environment variablesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0142Accidental public disclosure of internal resourcesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0145Bypass of outbound traffic controlCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0150Runtime logic bombCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0152IDECited from a security article or vendor blog in the original YAML; not a first-party incident report. DEF CON 31: malicious Visual Studio projects and WorkspaceT0157CombosquattingCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0163Runtime leakage of passwordCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0167Recursive PRCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0173Auto merge rules in SCMCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0174SaaS sprawlCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0175Untagged resourcesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0176Disable or misconfigure security measuresCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0177Misconfiguration of serverless workloadsCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0178Deploy keysCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0180Compromise services / serversCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0181Malicious module injectionCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0187Exposed storageCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0189Secrets in configuration filesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0193Sensitive information in environment variablesCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0195Spoofed CommitsCited from a security article or vendor blog in the original YAML; not a first-party incident report.T0197Use code from untrusted sourceInherited article citation; conference: DEF CON 34 “Hacking the Hackers who Hack Hackers” (Morag) — operators install FirewallFalcon from GitHub/Telegram, outsiT0198Malicious Build Time DependenciesCited from a security article or vendor blog in the original YAML; not a first-party incident report.