Poisoned Pipeline / Techniques / T0114
Compromised service account
Artifact Security Cloud Security Infrastructure as code SCM Posture
In this type of attack, the attacker gains access to a legitimate service account, which is typically used by an application or service to access cloud resources or manage infrastructure.
The attacker can use the compromised service account to perform actions that are authorized for the service account, such as reading, modifying, or deleting data.
This can result in data theft, unauthorized access to sensitive resources, and the ability to launch further attacks on other resources within the cloud environment.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1130 Implement password rotation
- M1131 Disable or lock compromised accounts
- M1240 Enable data encryption at rest
- M1550 Implement strict access control for clouds
- M1661 Revoke user permissions
Detections
- D1130 Implement account activity monitoring
- D1131 Implement SIEM
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (2)
- Codecov Breach
- Stolen ConnectWise Cloud Backup application identities signed in to customer Microsoft 365 tenants