{
  "technique_id": "T1677",
  "name": "Poisoned Pipeline Execution",
  "tactics": [
    "Execution"
  ],
  "platforms": [
    "SaaS"
  ],
  "summary": "Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines: * In a <b>Direct Pipeline Execution</b> scenario, the threat actor directly modifies the CI configuration file (e.g., `gitlab-ci.yml` in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact...",
  "generated_by": "SOC Response Atlas by Basyrix"
}