DET0533 Detection Strategy for Poisoned Pipeline Execution via SaaS CI/CD Workflows
| Item |
Value |
| ID |
DET0533 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1677 (Poisoned Pipeline Execution)
Analytics
SaaS
AN1473
Detects anomalous CI/CD workflow execution originating from forked repositories, with pull request (PR) metadata or commit messages containing suspicious patterns (e.g., encoded payloads), coupled with the use of insecure pipeline triggers like pull_request_target or excessive API usage of CI/CD secrets. Correlation with unusual artifact generation or secret exfiltration via encoded or external network destination URLs confirms suspicious behavior.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Time delta between PR creation and workflow execution to flag rapid attempts |
| UserContext |
Forked or external user accounts triggering workflows; may differ across orgs |
| TriggerTypeAllowlist |
CI trigger types (e.g., pull_request_target) that should or shouldn’t be used for forks |
| ArtifactEntropyThreshold |
Entropy threshold for detecting encoded payloads in artifacts |
| SecretAccessRateThreshold |
Rate of secret access in a single workflow run that might indicate abuse |