Poisoned Pipeline / Techniques / T0116
Shadow IT
Artifact Security CI/CD Posture Cloud Security Container Security Open Source Security SCM Posture Secrets Hygiene
Shadow IT refers to the use of information technology, including software, applications, services, and devices, by employees without the approval or knowledge of the IT department.
It poses a risk to various areas of security, including cloud security, artifact security, CI/CD posture, container security, and open-source security.
Shadow IT can result in the use of unapproved tools, libraries, or dependencies that may contain vulnerabilities or malicious code, leading to data breaches and other security incidents.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1450 Implement zero trust
- M1451 Use network segmentation
- M1503 Implement SCA analysis
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1500 Configure monitoring of used artifacts and open-source libraries
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
- D1590 Implement continuous monitoring and logging of the CI/CD process
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.