Poisoned Pipeline / Techniques / T0146
Misconfigured audit logs settings
CI/CD Posture Cloud Security SCM Posture
Misconfigured audit logs are a type of attack where an attacker modifies or disables audit logs to hide their malicious activities.
This technique is commonly used in cloud, CI/CD, and SCM environments.
In these environments, misconfigured audit logs can allow an attacker to modify or delete logs, making it difficult for security teams to detect and investigate the attack.
The attacker can also disable audit logging to evade detection.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://blog.marcolancini.it/2019/blog-cross-account-auditing/
- https://blog.marcolancini.it/continuous-cloud-visibility/
Mitigations
- M1440 Review logging settings
- M1441 Implement centralized logging
- M1550 Implement strict access control for clouds
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system