Poisoned Pipeline / Techniques / T0200
Proprietary data stolen
Code Security Cloud Security SCM Posture Secrets Hygiene
After a supply-chain foothold is established, the attacker steals proprietary
data — source code, designs, internal documents, customer lists, or trade secrets.
This is often the realized value of a compromise for espionage-motivated actors
and is the Impact-column outcome that earlier tactics were missing.
Distinct from a generic secret leak: the objective is the organization's
intellectual property, not only credentials.
Where this idea came from
This catalogue, from upstream issue #84 (Impact: proprietary data stolen).
- https://attack.mitre.org/tactics/TA0010/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-008a
- https://github.com/pbom-dev/OSCAR/issues/84
Mitigations
- M1120 Store credentials in vault
- M1250 Enable data encryption in transit
- M1860 Implement strong authentication mechanisms
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (5)
- Hijacked AI coding assistant spreads Shai-Hulud
- SolarWinds
- hermes-px PyPI steals AI conversations
- Exposed operator staging host reveals autonomous AI-agent crypto-theft fleet
- Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos