Living Off the Pipeline: Detecting Poisoned Pipeline Execution in CI/CD Environments

---
title: Potential Poisoned Pipeline Execution - Jenkins Process Anomaly
id: 8a2b3c4d-5e6f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious child processes spawned by the Jenkins service or agents, indicative of command execution via a compromised Jenkinsfile.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://www.sentinelone.com/blog/living-off-the-pipeline-defending-against-ci-cd-subversion/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.execution
  - attack.t1059.004
  - attack.software_supply_chain
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/jenkins-agent'
      - '/jenkins-slave'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/perl'
  selection_network:
    CommandLine|contains:
      - 'curl '
      - 'wget '
      - 'nc '
      - 'socket'
  condition: selection_parent and selection_child and selection_network
falsepositives:
  - Legitimate build scripts that download dependencies (validate allowlists)
level: high
---
title: Git Hook Execution via CI Runner
id: 9b3c4d5e-6f7a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects execution of git hooks (e.g., post-merge, pre-push) which are often abused in CI environments to establish persistence or trigger malicious code.
references:
  - https://www.sentinelone.com/blog/living-off-the-pipeline-defending-against-ci-cd-subversion/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.persistence
  - attack.t1546
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/git'
    CommandLine|contains:
      - 'hook'
      - '.git/hooks/'
  filter_main:
    ParentImage|endswith:
      - '/git' # Normal git ops
      - '/ssh' # Git over ssh
  condition: selection and not filter_main
falsepositives:
  - Rare manual git hook execution by developers (investigate context)
level: medium
---
title: GitHub Actions Runner Spawning Reverse Shell
id: 1c2d3e4f-7g8h-6i7j-0e1f-2g3h4i5j6k7l
status: experimental
description: Detects GitHub Actions Runner worker processes spawning network utilities commonly used for reverse shells.
references:
  - https://www.sentinelone.com/blog/living-off-the-pipeline-defending-against-ci-cd-subversion/
author: Security Arsenal
date: 2025/04/01
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'Runner.Worker'
      - 'bin/Runner.Listener'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
  selection_suspicious_cli:
    CommandLine|contains:
      - '/dev/tcp/'
      - 'bash -i'
      - 'exec 5<>/'
  condition: selection_parent and selection_child and selection_suspicious_cli
falsepositives:
  - Unlikely; highly indicative of abuse
level: critical

// Hunt for CI tools spawning unauthorized network connections
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in (\"java\", \"Runner.Worker\", \"gitlab-runner\", \"javaw\")
| where ProcessFileName in (\"curl\", \"wget\", \"python\", \"python3\", \"perl\", \"bash\", \"sh\", \"nc\")
| extend ProcessCmdLine = coalesce(ProcessCommandLine, \"\")
| where ProcessCmdLine matches regex @\"http[s]?://[^\s]+\" 
       or ProcessCmdLine contains \"/dev/tcp/\"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessFileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for recently modified git hooks in common CI directories
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs=\"/*/.git/hooks/*\")
WHERE Mtime > now() - 24h
   AND Mode.ModeString =~ \"x\"

-- Identify running processes that look like CI agents
SELECT Pid, Name, Exe, Username, CommandLine, Ctime
FROM pslist()
WHERE Name =~ \"java\" 
   OR Name =~ \"Runner\"
   OR Exe =~ \"jenkins\"

#!/bin/bash

# Audit CI/CD Repositories for hardcoded secrets and risky hooks
echo \"[*] Starting CI/CD Security Audit...\"

# Define directories to scan (modify based on your environment)
SCAN_DIRS=(\"/var/jenkins_home\" \"/home/gitlab-runner/builds\" \"/opt/actions-runner\")

# 1. Check for exposed secrets in YAML/Jenkinsfiles
echo \"[*] Scanning for hardcoded secrets in CI definitions...\"
KEYWORDS=(\"password\" \"secret\" \"api_key\" \"private_key\" \"aws_access\" \"token\")

for dir in \"${SCAN_DIRS[@]}\"; do
    if [ -d \"$dir\" ]; then
        echo \"    Scanning $dir ...\"
        find \"$dir\" -type f \\( -name \"Jenkinsfile\" -o -name \"*.yml\" -o -name \"*.yaml\" \\) -exec grep -i -l -E \"(${KEYWORDS[*]})\" {} \\;
    fi
done

# 2. Audit Git Hooks for suspicious modifications
echo \"[*] Scanning for recently modified Git hooks...\"
find / -type d -name \".git\" 2>/dev/null | while read gitdir; do
    hooksdir=\"$gitdir/hooks\"
    if [ -d \"$hooksdir\" ]; then
        # Find hooks modified in the last 24 hours or are world-writable
        find \"$hooksdir\" -type f -perm -o+w -o -mtime -1
    fi
done

echo \"[*] Audit complete. Review findings manually.\"