Poisoned Pipeline / Techniques
Techniques
117 techniques across 12 tactics.
T0100ReconnaissanceDiscover naming conventionsT0101ReconnaissanceDiscover technology stacksT0102ReconnaissanceDiscover used open-source dependenciesT0103ReconnaissanceScan public artifacts for secretsT0104ReconnaissanceDiscover coding flawsT0105ReconnaissanceActive scanningT0106ReconnaissanceScan configuration on public resourcesT0107ReconnaissanceDiscover internal artifacts namesT0108Resource DevelopmentAccounts in public registryT0109Resource DevelopmentPublish malicious artifactT0110Resource DevelopmentAdvertise malicious artifactT0111Resource DevelopmentMalicious code contribution to an open-source repositoryT0112Initial AccessCompromised tokenT0113Initial AccessCompromised user accountT0114Initial AccessCompromised service accountT0115Initial AccessRepojackingT0116Initial AccessShadow ITT0117ExecutionSQL injectionT0118ExecutionCommand injectionT0119ExecutionCross-site scriptingT0120Initial AccessDependency confusionT0121Resource DevelopmentCompromised legitimate artifactT0122Initial AccessVulnerability in third-party CI/CD actionsT0123Initial AccessExposed internal APIT0124CollectionUnencrypted data at restT0125CollectionUnencrypted data in transitT0126Initial AccessExposed storageT0127Initial AccessExposed databaseT0128Initial AccessPermissive network accessT0129Initial AccessTyposquattingT0130Credential AccessHarvest secrets from logsT0131Lateral MovementOverprivileged user accountT0132Privilege EscalationOverprivileged CI/CD RunnersT0133Initial AccessVulnerable CICD pluginsT0134PersistenceAdd userT0135Initial AccessVulnerable CICD systemT0136Initial AccessBrandjackingT0137Initial AccessWeak authentication methodsT0138PersistenceBackdoor in codeT0139ImpactResource hijackingT0140Credential AccessHarvest tokens from environment variablesT0141Resource DevelopmentFake developer reputation (Starjacking)T0142ReconnaissanceAccidental public disclosure of internal resourcesT0143Initial AccessExternal user accountsT0144Defense EvasionMisconfigured traffic log settingsT0145ExfiltrationBypass of outbound traffic controlT0146Defense EvasionMisconfigured audit logs settingsT0147ReconnaissanceScan public CI/CD configurations for secrets and vulnerable actionsT0148PersistenceScheduled tasks on self hosted runnerT0149ImpactDelete repositoriesT0150ExecutionRuntime logic bombT0151ExecutionInstallation scriptsT0152ExecutionIDET0153Initial AccessCompromised developer workstationT0154Initial AccessMalicious IDE extensionT0155ExecutionCloud workloadT0156ExfiltrationExfiltration over webhooksT0157Initial AccessCombosquattingT0158Initial AccessVulnerable CI/CD templateT0159ExecutionMalicious artifact executionT0161PersistenceImplant in zombie instanceT0162Credential AccessPasswords in CI/CD logsT0163Credential AccessRuntime leakage of passwordT0164Privilege EscalationInject malicious dependency to privileged user repositoryT0165PersistenceCreate access tokenT0166ExecutionTrigger pipeline executionT0167PersistenceRecursive PRT0168ExfiltrationExfiltration to code repositoriesT0169Lateral MovementPush implants across repositoriesT0170Defense EvasionMalicious compiler or interpreterT0172ExecutionRuntime backdoorT0173ExecutionAuto merge rules in SCMT0174Defense EvasionSaaS sprawlT0175PersistenceUntagged resourcesT0176Defense EvasionDisable or misconfigure security measuresT0177ImpactMisconfiguration of serverless workloadsT0178PersistenceDeploy keysT0179Initial AccessExposed webHookT0180Initial AccessCompromise services / serversT0181Initial AccessMalicious module injectionT0182Defense EvasionBypass review using admin permissionT0183Credential AccessHarvesting short-lived tokenT0184Credential AccessHarvesting sensitive information from filesT0185Credential AccessSteal credentials in container artifactsT0186ImpactSource code leakT0187ReconnaissanceExposed storageT0188ExecutionCross Site Request ForgeryT0189Credential AccessSecrets in configuration filesT0190CollectionWeak encryptionT0191ImpactMalicious code in artifactsT0192CollectionSensitive information in logsT0193CollectionSensitive information in environment variablesT0194Initial AccessOutdated software componentsT0195Defense EvasionSpoofed CommitsT0196ImpactBackdoor in codeT0197Initial AccessUse code from untrusted sourceT0198Defense EvasionMalicious Build Time DependenciesT0199ImpactSecret leakT0200ImpactProprietary data stolenT0201ImpactCustomers compromisedT0202PersistenceInadequate CI/CD workflow permissionsT0203ReconnaissanceDiscover localized out-of-band deploymentsT0205Initial AccessCompromise third-party CDN or hosted web assetT0206Defense EvasionForge or omit build provenanceT0207Defense EvasionSkip or forge artifact integrity verificationT0208Defense EvasionCompromise code-signing identityT0209Initial AccessCompromise package registry or CDN originT0210PersistencePoison AI coding-agent config or workspaceT0211ExecutionAbuse registry-adjacent builders as remote executionT0212Initial AccessSubvert network routing to intercept update trafficT0213ExecutionOrchestrate AI-agent fleet as the intrusion workforceT0214ReconnaissanceRent co-located containers to scan an isolated networkT0215Defense EvasionEnroll attacker-owned code-signing identityT0216ImpactWipe developer profile if a stolen token is revokedT0217Resource DevelopmentBuild trusted artifacts from an attacker-controlled sourceT0218Defense EvasionCompromise TLS trust identityT0219ExfiltrationExfiltrate secrets through the CI platform's own log store