Code injection in connected repository

Info

ID: MS-TA7003
Tactic: Initial Access
MITRE technique: T1195.002

Attackers may inject malicious code into source repositories that are linked to cloud web applications or serverless functions. If these repositories are automatically synced with production environments, the injected code executes under the legitimate workflows.

For example, if an attacker is able to commit malicious code into GitHub repository connected to GCP Cloud Functions via Cloud Build triggers, their code will be deployed into the application.

Mitigations

ID	Mitigation	Description
MS-M7008	Secure CI/CD pipelines	Protect build and deployment systems with access controls, branch protection, and mandatory code review requirements.
MS-M7009	Enforce code review and approval workflows	Require peer review and approval before merging code changes to production branches.