Merge pull request #105 from pbom-dev/oscar-content-2023-10

updating cicd related techniques
pbom-dev · Oct 26, 2023 · 96fec0a · 96fec0a
2 parents edda7dd + fdd5b9a
commit 96fec0a
Show file tree

Hide file tree

Showing 18 changed files with 18 additions and 1 deletion.
diff --git a/content/oscar/techniques/T0120 - Dependency Confusion.yaml b/content/oscar/techniques/T0120 - Dependency Confusion.yaml
@@ -7,6 +7,7 @@ realm:
   - Artifact Security
   - Container Security
   - Open Source Security
+  - CI/CD Posture
 
 summary: Dependency confusion
 

diff --git a/content/oscar/techniques/T0121 - Compromised legitimate artifact.yaml b/content/oscar/techniques/T0121 - Compromised legitimate artifact.yaml
@@ -6,6 +6,7 @@ tactic: Resource Development
 realm: 
   - Container Security
   - Open Source Security
+  - CI/CD Posture
 
 summary: Compromised legitimate artifact
 

diff --git a/content/oscar/techniques/T0124 - Unencrypted data at rest.yaml b/content/oscar/techniques/T0124 - Unencrypted data at rest.yaml
@@ -6,6 +6,7 @@ tactic: Collection
 realm: 
   - Cloud Security
   - Infrastructure as code
+  - CI/CD Posture
 
 summary: Unencrypted data at rest
 

diff --git a/content/oscar/techniques/T0125 - Unencrypted data at transit.yaml b/content/oscar/techniques/T0125 - Unencrypted data at transit.yaml
@@ -6,6 +6,7 @@ tactic: Collection
 realm: 
   - Cloud Security
   - Infrastructure as code
+  - CI/CD Posture  
 
 summary: Unencrypted data in transit
 

diff --git a/content/oscar/techniques/T0128 - Permissive network access.yaml b/content/oscar/techniques/T0128 - Permissive network access.yaml
@@ -6,6 +6,7 @@ tactic: Initial Access
 realm: 
   - Cloud Security
   - Infrastructure as code
+  - CI/CD Posture
 
 summary: Permissive network access
 

diff --git a/content/oscar/techniques/T0129 - Typosquatting.yaml b/content/oscar/techniques/T0129 - Typosquatting.yaml
@@ -6,6 +6,7 @@ tactic: Initial Access
 realm: 
   - Container Security
   - Open Source Security
+  - CI/CD Posture
 
 summary: Typosquatting
 

diff --git a/content/oscar/techniques/T0134 - Add user.yaml b/content/oscar/techniques/T0134 - Add user.yaml
@@ -6,6 +6,7 @@ tactic: Persistence
 realm: 
   - CI/CD Posture
   - SCM Posture
+  - Cloud Security
 
 summary: Add user
 

diff --git a/content/oscar/techniques/T0137 - Weak authentication methods.yaml b/content/oscar/techniques/T0137 - Weak authentication methods.yaml
@@ -7,6 +7,7 @@ realm:
   - Cloud Security
   - Code Security
   - Infrastructure as code
+  - CI/CD Posture
 
 summary: Weak authentication methods
 

diff --git a/content/oscar/techniques/T0138 - Backdoor in code.yaml b/content/oscar/techniques/T0138 - Backdoor in code.yaml
@@ -7,6 +7,7 @@ realm:
   - Code Security
   - Open Source Security
   - SCM Posture
+  - CI/CD Posture
 
 summary: Backdoor in code
 

diff --git a/content/oscar/techniques/T0145 - Bypass of outbound traffic control.yaml b/content/oscar/techniques/T0145 - Bypass of outbound traffic control.yaml
@@ -5,6 +5,7 @@ tactic: Exfiltration
 
 realm: 
   - Cloud Security
+  - CI/CD Posture
 
 summary: Bypass of outbound traffic control
 

diff --git a/content/oscar/techniques/T0156 - Webhook.yaml b/content/oscar/techniques/T0156 - Webhook.yaml
@@ -5,6 +5,7 @@ tactic: Exfiltration
 
 realm: 
   - SCM Posture
+  - CI/CD Posture
 
 summary: Exfiltration over webhooks
 

diff --git a/content/oscar/techniques/T0159 - Malicious artifact execution.yaml b/content/oscar/techniques/T0159 - Malicious artifact execution.yaml
@@ -6,6 +6,7 @@ tactic: Execution
 realm: 
   - Artifact Security
   - Open Source Security
+  - CI/CD Posture
 
 summary: Malicious artifact execution
 

diff --git a/content/oscar/techniques/T0169 - Push implants across repositories .yaml b/content/oscar/techniques/T0169 - Push implants across repositories .yaml
@@ -6,6 +6,7 @@ tactic: Lateral Movement
 realm: 
   - Code Security
   - SCM Posture
+  - CI/CD Posture
 
 summary: Push implants across repositories 
 

diff --git a/content/oscar/techniques/T0176 - Misconfiguration of security measures.yaml b/content/oscar/techniques/T0176 - Misconfiguration of security measures.yaml
@@ -5,6 +5,7 @@ tactic: Defense Evasion
 
 realm: 
   - Cloud Security
+  - CI/CD Posture
 
 summary: Misconfigured security measures
 

diff --git a/content/oscar/techniques/T0182 - Bypass Review using admin permission.yaml b/content/oscar/techniques/T0182 - Bypass Review using admin permission.yaml
@@ -4,8 +4,8 @@ type: Technique
 tactic: Defense Evasion
 
 realm: 
-  - CI/CD Posture
   - SCM Posture
+  - Code Security
 
 summary: Bypass review using admin permission
 

diff --git a/content/oscar/techniques/T0189 - Secrets in configuration files.yaml b/content/oscar/techniques/T0189 - Secrets in configuration files.yaml
@@ -5,6 +5,7 @@ tactic: Credential Access
 
 realm:
   - Secrets Hygiene
+  - CI/CD Posture
 
 summary: Secrets in configuration files
 

diff --git a/content/oscar/techniques/T0193 - Sensitive information in environment variables.yaml b/content/oscar/techniques/T0193 - Sensitive information in environment variables.yaml
@@ -5,6 +5,7 @@ tactic: Collection
 
 realm: 
   - Cloud Security
+  - CI/CD Posture
 
 summary: Sensitive information in environment variables
 

diff --git a/content/oscar/techniques/T0196 - Backdoor in code.yaml b/content/oscar/techniques/T0196 - Backdoor in code.yaml
@@ -7,6 +7,7 @@ realm:
   - Code Security
   - Open Source Security
   - SCM Posture
+  - CI/CD Posture
 
 summary: Backdoor in code