mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-31 21:50:50 +03:00
mukul975
cb8d79e068
- Add validated mitre_attack frontmatter to all 754 skills (286 distinct techniques), verified against MITRE ATT&CK v19.1 via the official mitreattack-python library: 0 revoked, deprecated, or invalid IDs - Curate precise per-skill technique IDs for forensics, malware-analysis, threat-intel, and red-team skills (e.g. DCSync -> T1003.006, Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003) - Reconcile v19.1 tactic restructuring: Defense Evasion split into Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.* family and T1070.001/.002 remapped to active equivalents (T1685.*) - Normalize word-split tags across 35 skills (remove filename-derived stopword tags, add semantic cybersecurity tags) - Add api-reference.md for 3 skills that were missing it - Update README ATT&CK section with accurate v19.1 tactic distribution
92 lines
2.6 KiB
Markdown
92 lines
2.6 KiB
Markdown
---
|
|
name: detecting-supply-chain-attacks-in-ci-cd
|
|
description: 'Scans GitHub Actions workflows and CI/CD pipeline configurations for
|
|
supply chain attack vectors including unpinned actions, script injection via expressions,
|
|
dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated
|
|
audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
|
|
|
|
'
|
|
domain: cybersecurity
|
|
subdomain: security-operations
|
|
tags:
|
|
- supply-chain-security
|
|
- ci-cd-security
|
|
- github-actions
|
|
- pipeline-security
|
|
- dependency-pinning
|
|
- devsecops
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
atlas_techniques:
|
|
- AML.T0010
|
|
- AML.T0104
|
|
nist_ai_rmf:
|
|
- GOVERN-5.2
|
|
- MAP-1.6
|
|
- MANAGE-2.2
|
|
nist_csf:
|
|
- DE.CM-01
|
|
- RS.MA-01
|
|
- GV.OV-01
|
|
- DE.AE-02
|
|
mitre_attack:
|
|
- T1195.002
|
|
- T1195.001
|
|
- T1199
|
|
- T1554
|
|
---
|
|
|
|
# Detecting Supply Chain Attacks in CI/CD
|
|
|
|
|
|
## When to Use
|
|
|
|
- When investigating security incidents that require detecting supply chain attacks in ci cd
|
|
- When building detection rules or threat hunting queries for this domain
|
|
- When SOC analysts need structured procedures for this analysis type
|
|
- When validating security monitoring coverage for related attack techniques
|
|
|
|
## Prerequisites
|
|
|
|
- Familiarity with security operations concepts and tools
|
|
- Access to a test or lab environment for safe execution
|
|
- Python 3.8+ with required dependencies installed
|
|
- Appropriate authorization for any testing activities
|
|
|
|
## Instructions
|
|
|
|
Scan CI/CD workflow files for supply chain risks by parsing GitHub Actions YAML,
|
|
checking for unpinned dependencies, script injection vectors, and secrets exposure.
|
|
|
|
```python
|
|
import yaml
|
|
from pathlib import Path
|
|
|
|
for wf in Path(".github/workflows").glob("*.yml"):
|
|
with open(wf) as f:
|
|
workflow = yaml.safe_load(f)
|
|
for job_name, job in workflow.get("jobs", {}).items():
|
|
for step in job.get("steps", []):
|
|
uses = step.get("uses", "")
|
|
if uses and "@" in uses and not uses.split("@")[1].startswith("sha"):
|
|
print(f"Unpinned action: {uses} in {wf.name}")
|
|
```
|
|
|
|
Key supply chain risks:
|
|
1. Unpinned GitHub Actions (using @main instead of SHA)
|
|
2. Script injection via ${{ github.event }} expressions
|
|
3. Overly permissive GITHUB_TOKEN permissions
|
|
4. Third-party actions with write access to repo
|
|
5. Dependency confusion via public/private package name collision
|
|
|
|
## Examples
|
|
|
|
```python
|
|
# Check for script injection in run steps
|
|
for step in job.get("steps", []):
|
|
run_cmd = step.get("run", "")
|
|
if "${{" in run_cmd and "github.event" in run_cmd:
|
|
print(f"Script injection risk: {run_cmd[:80]}")
|
|
```
|