Poisoned Pipeline / Techniques / T0142
Accidental public disclosure of internal resources
This technique involves searching for internal resources that have been inadvertently made public and are accessible to anyone on the internet.
An attacker can use this technique to identify internal resources that may contain sensitive information such as passwords, API keys, or other credentials.
They can also use this technique to identify other internal resources that may be of interest, such as databases or servers.
There are several ways that internal resources can be accidentally made public, including misconfigured security settings, unintentional exposure of credentials, or through the use of unsecured storage buckets.
When resources are accidentally made public, it can be easy for an attacker to locate and access them.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1240 Enable data encryption at rest
- M1250 Enable data encryption in transit
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system