Poisoned Pipeline / Techniques / T0178
Deploy keys
Deploy keys are SSH keys that are used to authenticate a specific machine or service to access a repository or codebase in a SCM system like Git.
They are typically used to automate deployments or integrations between services and repositories.
In this attack technique, an attacker gains access to a machine that has deploy keys configured for access to a repository or codebase.
Once they have access, they can obtain the private key of the deploy key and use it to gain access to the repository or codebase from other machines or services, even if the original machine is no longer accessible.
By doing so, the attacker can maintain persistent access to the repository or codebase, allowing them to steal sensitive information, introduce malicious code or manipulate the codebase to conduct further attacks.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1661 Revoke user permissions
- M1780 Restrict access to machines with deploy keys
- M1781 Use dedicated machines for deploy keys
- M1782 Securely store private keys
- M1783 Rotate deploy keys regularly
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1780 Monitor authentication logs
- D1781 Audit and review deploy key access