1200KM / detection
T1677 Poisoned Pipeline Execution — Detection Rules
Detection workspace for T1677 Poisoned Pipeline Execution: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0533 Detection Strategy for Poisoned Pipeline Execution via SaaS CI/CD Workflows
AN1473 Analytic 1473
Detects anomalous CI/CD workflow execution originating from forked repositories, with pull request (PR) metadata or commit messages containing suspicious patterns (e.g., encoded payloads), coupled with the use of insecure pipeline triggers like `pull_request_target` or excessive API usage of CI/CD secrets. Correlation with unusual artifact generation or secret exfiltration via encoded or external network destination URLs confirms suspicious behavior.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- Cloud Service Metadata · DC0070
- Cloud Service Modification · DC0069
- Cloud Storage Access · DC0025
- Command Execution · DC0064
- File Metadata · DC0059
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.