Poisoned Pipeline / Techniques / T0163
Runtime leakage of password
Code Security Container Security Open Source Security
This attack technique involves searching for passwords or other sensitive information that is passed as parameters or environment variables during the runtime of a code or containerized application.
Attackers can exploit this vulnerability by intercepting the runtime process and capturing the sensitive information in transit.
Once the password or sensitive information is captured, the attacker can use it to gain unauthorized access to the system or associated resources.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1120 Store credentials in vault
- M1630 Implement runtime encryption
Detections
- D1120 Implement source code scanning for credentials and tokens
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.