Poisoned Pipeline / Techniques / T0144
Misconfigured traffic log settings
If the logging settings are misconfigured or disabled, attackers can evade attack detection and hide their malicious activities in the network.
For example, an attacker can exploit misconfigured traffic log settings to delete or modify log files, preventing security teams from detecting their activities.
Attackers can also use traffic obfuscation techniques to hide their activities, such as using encryption or tunneling to bypass network security controls and avoid detection.
If the logging settings are misconfigured, security teams may not have visibility into these types of network activities, making it easier for attackers to evade detection.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://blog.marcolancini.it/2021/blog-security-logging-cloud-environments-gcp/
- https://blog.marcolancini.it/continuous-cloud-visibility/
Mitigations
- M1440 Review logging settings
- M1441 Implement centralized logging
- M1550 Implement strict access control for clouds
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system