Techniques › T1677 › AN1473
AN1473 Analytic 1473
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects anomalous CI/CD workflow execution originating from forked repositories, with pull request (PR) metadata or commit messages containing suspicious patterns (e.g., encoded payloads), coupled with the use of insecure pipeline triggers like
pull_request_target or excessive API usage of CI/CD secrets. Correlation with unusual artifact generation or secret exfiltration via encoded or external network destination URLs confirms suspicious behavior.</p>- Detects
- T1677 Poisoned Pipeline Execution
- Part of
- DET0533 Detection Strategy for Poisoned Pipeline Execution via SaaS CI/CD Workflows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:github | Workflow triggered via pull_request_target from forked repo | DC0069 Cloud Service Modification |
| saas:github | CI/CD secret accessed or exported | DC0070 Cloud Service Metadata |
| saas:github | Artifact generated includes base64/encoded exfil payload or URL | DC0025 Cloud Storage Access |
| saas:RepoEvents | New file added or modified in PR targeting CI/CD or build config (e.g., `gitlab-ci.yml`, `build.gradle`, `pom.xml`, `.github/workflows/*.yml`) | DC0059 File Metadata |
| saas:PRMetadata | Commit message or branch name contains encoded strings or payload indicators | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Time delta between PR creation and workflow execution to flag rapid attempts |
UserContext | Forked or external user accounts triggering workflows; may differ across orgs |
TriggerTypeAllowlist | CI trigger types (e.g., `pull_request_target`) that should or shouldn't be used for forks |
ArtifactEntropyThreshold | Entropy threshold for detecting encoded payloads in artifacts |
SecretAccessRateThreshold | Rate of secret access in a single workflow run that might indicate abuse |