Poisoned Pipeline / Techniques / T0167
Recursive PR
The Recursive PR attack technique is a persistence tactic that involves an attacker submitting a pull request to a repository that contains a malicious code change.
Once the pull request is merged and the code change is deployed, the malicious code is executed and establishes a persistent presence in the CI/CD pipeline.
The attack works by creating a chain of pull requests where each subsequent pull request is used to modify the code introduced in the previous pull request.
This creates a recursive loop where the pipeline will continuously build and deploy new versions of the code that contain the attacker's modifications.
By doing so, the attacker can maintain a persistent presence in the CI/CD pipeline and potentially use it to execute further attacks.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1730 Implement code reviews
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process