Poisoned Pipeline / Techniques / T0181
Malicious module injection
Infrastructure as code
Malicious module injection is an attack that targets the Infrastructure as Code (IaC) process, where an attacker injects malicious code or modules into the configuration files used to define and provision infrastructure resources.
This can occur during the development or deployment phases of the IaC process, and the injected code can lead to backdoors, data breaches, resource hijacking, or integrity compromise.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
- https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/infrastructure-as-code-security-risks-and-how-to-avoid-them
- https://about.gitlab.com/blog/2022/02/17/fantastic-infrastructure-as-code-security-attacks-and-how-to-find-them/
Mitigations
- M1730 Implement code reviews
- M1731 Implement verification of signed commits
- M1732 Implement code scanning for security risks
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (4)
- Team PCP CI/CD secrets campaign
- TraderTraitor interview repos point Terraform at a lookalike provider registry
- axios npm remote-access trojan
- Miasma botnet loader in @asyncapi npm packages