mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
84 lines
2.4 KiB
Markdown
84 lines
2.4 KiB
Markdown
---
|
|
name: detecting-supply-chain-attacks-in-ci-cd
|
|
description: 'Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned
|
|
actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for
|
|
automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
|
|
|
|
'
|
|
domain: cybersecurity
|
|
subdomain: security-operations
|
|
tags:
|
|
- detecting
|
|
- supply
|
|
- chain
|
|
- attacks
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
atlas_techniques:
|
|
- AML.T0010
|
|
- AML.T0104
|
|
nist_ai_rmf:
|
|
- GOVERN-5.2
|
|
- MAP-1.6
|
|
- MANAGE-2.2
|
|
nist_csf:
|
|
- DE.CM-01
|
|
- RS.MA-01
|
|
- GV.OV-01
|
|
- DE.AE-02
|
|
---
|
|
|
|
# Detecting Supply Chain Attacks in CI/CD
|
|
|
|
|
|
## When to Use
|
|
|
|
- When investigating security incidents that require detecting supply chain attacks in ci cd
|
|
- When building detection rules or threat hunting queries for this domain
|
|
- When SOC analysts need structured procedures for this analysis type
|
|
- When validating security monitoring coverage for related attack techniques
|
|
|
|
## Prerequisites
|
|
|
|
- Familiarity with security operations concepts and tools
|
|
- Access to a test or lab environment for safe execution
|
|
- Python 3.8+ with required dependencies installed
|
|
- Appropriate authorization for any testing activities
|
|
|
|
## Instructions
|
|
|
|
Scan CI/CD workflow files for supply chain risks by parsing GitHub Actions YAML,
|
|
checking for unpinned dependencies, script injection vectors, and secrets exposure.
|
|
|
|
```python
|
|
import yaml
|
|
from pathlib import Path
|
|
|
|
for wf in Path(".github/workflows").glob("*.yml"):
|
|
with open(wf) as f:
|
|
workflow = yaml.safe_load(f)
|
|
for job_name, job in workflow.get("jobs", {}).items():
|
|
for step in job.get("steps", []):
|
|
uses = step.get("uses", "")
|
|
if uses and "@" in uses and not uses.split("@")[1].startswith("sha"):
|
|
print(f"Unpinned action: {uses} in {wf.name}")
|
|
```
|
|
|
|
Key supply chain risks:
|
|
1. Unpinned GitHub Actions (using @main instead of SHA)
|
|
2. Script injection via ${{ github.event }} expressions
|
|
3. Overly permissive GITHUB_TOKEN permissions
|
|
4. Third-party actions with write access to repo
|
|
5. Dependency confusion via public/private package name collision
|
|
|
|
## Examples
|
|
|
|
```python
|
|
# Check for script injection in run steps
|
|
for step in job.get("steps", []):
|
|
run_cmd = step.get("run", "")
|
|
if "${{" in run_cmd and "github.event" in run_cmd:
|
|
print(f"Script injection risk: {run_cmd[:80]}")
|
|
```
|