T1677 — Poisoned Pipeline Execution

Tactic: Execution · Platforms: SaaS

Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a <b>Direct Pipeline Execution</b> scenario, the threat actor directly modifies the CI…

Sigma detection rules (1)

T1677 Poisoned Pipeline Execution

title: T1677 Poisoned Pipeline Execution
id: f5d71667-768f-4a1c-9a75-2cd725a9bbcf
description: 'Detection Strategy for Poisoned Pipeline Execution via SaaS CI/CD Workflows. (Data Component: Cloud Service Modification; baseline tier: fallback.) Tune using: TimeWindow, UserContext, TriggerTypeAllowlist, ArtifactEntropyThreshold, SecretAccessRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1677
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.execution
  - attack.t1677

logsource:
  product: saas
  service: github

detection:
  selection_pr_workflow:
    action: 'workflow_run.completed'
  selection_branch_override:
    action: 'protected_branch.policy_override'
  selection_secret_scan_resolve:
    action: 'secret_scanning_alert.resolve'

  condition: 1 of selection_*

falsepositives:
  - A maintainer legitimately overriding branch protection for an emergency hotfix or approving a fork pull request workflow run; trigger-type allowlisting and artifact-entropy scoring reduce false positives.

level: high

Explore