Poisoned Pipeline / Techniques / T0155
Cloud workload
Cloud Security
Adversaries can exploit serverless computing, integration, and automation services in cloud environments to execute arbitrary code.
This can be done through serverless functions, compute engines, application integration, and web servers.
The attackers can use these resources to run malicious code, such as crypto-mining malware or create functions that enable further compromise of the cloud environment.
Attackers may also use event-triggered execution to persistently execute serverless functions over time, such as creating Lambda functions in AWS environments that add additional cloud credentials to a user.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
- https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/
- https://blog.morphisec.com/what-is-cloud-workload-security
Mitigations
- M1532 Implement least privilege access controls
- M1550 Implement strict access control for clouds
- M1551 Use built-in security controls
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1550 Implement real-time monitoring of cloud resources
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.