Poisoned Pipeline / Techniques / T0131
Overprivileged user account
Artifact Security CI/CD Posture Cloud Security SCM Posture
The overprivileged user account attack is a technique of lateral movement tactic in which an attacker gains access to a user account with excessive privileges and uses that account to move laterally within a network, accessing resources and systems that they are not authorized to access.
It may affects Cloud, CI/CD accounts, an attacker can potentially manipulate the CI/CD pipeline or Cloud configuration to introduce malicious code into the software build or deployment process.
This could lead to the deployment of compromised software, which can result in data breaches, malware infections, or other security incidents.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://learn.microsoft.com/en-us/security/zero-trust/develop/overprivileged-permissions
- https://www.cyberark.com/what-is/privileged-access-management/
Mitigations
- M1310 Implement least privilege principle
- M1311 Implement multi-factor authentication
- M1550 Implement strict access control for clouds
- M1661 Revoke user permissions
Detections
- D1261 Implement penetration testing
- D1310 Monitor user access logs
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process