Poisoned Pipeline / Techniques / T0185
Steal credentials in container artifacts
Artifact Security
Attackers can steal credentials by searching through the container artifacts for any sensitive information that may have been inadvertently included, such as hard-coded passwords or API keys.
They can also intercept network traffic between containers and external systems to capture any credentials that may be transmitted in plaintext.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1550 Implement strict access control for clouds
Detections
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware