Poisoned Pipeline / Techniques / T0165

T0165 · Persistence · TA05 · observed in 2 incident(s)

Create access token

Following initial access, an attacker may attempt to create alternative means of access to the system that was infiltrated.
Since the initial access may use a temporary or temporary session token - a common adversary technique would be to create an access token which will persist the access to the system. For example, after getting an initial access by abusing a compromised 2FA backed session token an attacker created access tokens that allowed both persistence and lateral movement (Circle CI reference)

Where this idea came from

Public incident / advisory

Taken from a public incident, vendor advisory, or first-party write-up cited below.

• https://circleci.com/blog/jan-4-2023-incident-report/

Mitigations

• M1310 Implement least privilege principle
• M1311 Implement multi-factor authentication
• M1450 Implement zero trust
• M1451 Use network segmentation
• M1830 Restrict token access

Detections

• D1650 Audit rogue creation of API credentials

Observed in incidents (2)

• CircleCI December 2022 / January 2023 incident
• Stolen ConnectWise Cloud Backup application identities signed in to customer Microsoft 365 tenants

References

• https://circleci.com/blog/jan-4-2023-incident-report/