Poisoned Pipeline / Techniques / T0105
Active scanning
Cloud Security
This technique involves actively scanning an organization's cloud infrastructure for vulnerabilities and misconfigurations that can be exploited by attackers to gain unauthorized access or cause system disruption.
An attacker can use this technique to identify vulnerable assets within an organization's cloud infrastructure and develop an understanding of the target's attack surface.
By conducting active scanning, an attacker can gather information about an organization's network topology, application architecture, and security controls, and use this information to plan and execute more effective attacks.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://www.aquasec.com/cloud-native-academy/cspm/cloud-security-scanner/
- https://github.com/prowler-cloud/prowler
Mitigations
- M1450 Implement zero trust
- M1451 Use network segmentation
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware