🏗️ Honey CI/CD Pipeline

Fake pipeline definitions to catch supply chain attacks.

→ Explore in ATT&CK matrix (7 mappings) Deployment detail

What it is

A CI/CD pipeline that looks like a real deployment job but never runs, holding decoy secrets in its variables. Pipelines are attractive because they carry deploy credentials and can run code. Runs, edits and secret changes on the decoy pipeline are recorded in the platform's audit log, and a stolen secret alerts when used.

Implementation requirements

Create a pipeline that looks real: a workflow or job named like a deployment job, in a repository or folder next to real ones. It never runs on a schedule, and nothing legitimate triggers it
Give it decoy secrets in its variables or secret store, each a honeytoken (D006) for an identity that grants nothing
Monitoring: the platform audit log for runs, edits and secret changes on the decoy (GitHub audit log, GitLab audit events, Jenkins with an audit-trail plugin), plus the honeytoken's own alert when a stolen secret is used
Safety: the runner it targets is isolated, with no deploy credentials and no network path to production. Protected-branch and approval rules stay the same as on real pipelines
OPSEC: commit history and naming consistent with real pipelines. A pipeline nobody has touched in years can look abandoned and therefore safe to an intruder, which is acceptable
Rollback: Delete the pipeline and its decoy secrets. Revoke the honeytokens behind those secrets.
Upkeep: Keep its runner image and syntax current with real pipelines. Monthly proof-of-life read of a decoy secret.

Technologies

CI/CD

ATT&CK coverage 7

Technique	Tactic	Status	Confidence	Tier
T1213 Data from Information Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack; any use of one raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1213 to its Lures activity. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — (D051) LLM-integrated applications follow instructions hidden in content they retrieve. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — (D051) Prompt injections embedded in honeypot responses identified AI hacking agents in the wild (8 potential agents over three months).
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1677 Poisoned Pipeline Execution	Execution	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in CI/CD systems and repositories alert when used. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1677 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1677 Poisoned Pipeline Execution as an adversary behaviour.
T1195 Supply Chain Compromise	Initial Access	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1195 Supply Chain Compromise as an adversary behaviour. The compromise happens upstream of the defender.
T1195.002 Compromise Software Supply Chain	Initial Access	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1195.002 Compromise Software Supply Chain as an adversary behaviour. The compromise happens upstream.
T1072 Software Deployment Tools	Lateral Movement	theoretical	moderate	T3
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in CI/CD systems and repositories alert when used. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1072 Software Deployment Tools as an adversary behaviour. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1072 as feasible (medium) for infrastructure deception. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1072 to its Lures activity.
T1525 Implant Internal Image	Persistence	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1525 Implant Internal Image as an adversary behaviour.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
GitGuardian Honeytoken — core concepts — GitGuardian industry