Poisoned Pipeline / Techniques / T0134

T0134 · Persistence · TA05 · observed in 4 incident(s)

Add user

Add user attack technique involves adding a new user account with privileged access to the system, allowing the attacker to continue to perform malicious activities even if their original access is removed or revoked.
In this attack, the attacker gains access to the CI/CD system through various means, such as exploiting vulnerabilities or stealing credentials.
Once they have gained access, the attacker creates a new user account with elevated privileges, such as administrator or root access.
This allows the attacker to continue to access and control the system even if their original access is removed or blocked.

Where this idea came from

ATT&CK / AppSec analog

ATT&CK T1136 Create Account, applied to CI/CD, SCM, and cloud. Original YAML had no URL.

• https://attack.mitre.org/techniques/T1136/

Mitigations

• M1340 Implement regular account review
• M1860 Implement strong authentication mechanisms
• M1861 Implement strong authorization mechanisms

Detections

• D1260 Implement regular security audit and review
• D1261 Implement penetration testing
• D1262 Implement vulnerability assessment
• D1510 Implement Intrusion Detection System and anti-malware
• D1590 Implement continuous monitoring and logging of the CI/CD process

Observed in incidents (4)

• big.js typosquats sjs/bjs/cjs-biginteger SSH backdoors
• OptinMonster / TrustPulse / PushEngage plugin supply chain
• js-logger-pack probe to infostealer to dropper
• dom-utils-lite / centralogger SSH backdoor via Supabase

References

• https://attack.mitre.org/techniques/T1136/