Case Study: Microsoft detects a CI/CD supply chain attack in real time with StepSecurity Harden-Runner

Microsoft detects a CI/CD supply chain attack in under an hour with StepSecurity

Microsoft, a major technology company, faced a significant security challenge when a vulnerability was discovered in the CI/CD pipeline of its open-source Azure Karpenter Provider project. This misconfigured GitHub Actions workflow could have allowed an attacker to execute untrusted code with elevated permissions and exfiltrate sensitive credentials, potentially leading to a supply chain attack. To address this, Microsoft was already using StepSecurity's Harden-Runner product in audit mode to monitor its infrastructure.

StepSecurity's Harden-Runner solution detected this attack in real-time by identifying anomalous network egress traffic to suspicious domains, which was a clear deviation from the established baseline. The vendor, StepSecurity, immediately reported the incident to Microsoft's security team. As a result, Microsoft was able to quickly remediate the issue by removing the vulnerable trigger and configuring Harden-Runner to operate in block mode, preventing any future exfiltration attempts and securing its CI/CD pipeline against this emerging threat.

Microsoft