feat(SAFE-T1506): added [Infrastructure Token Theft]

[blaycoder]

Summary

Contributed to a technique: SAFE-T1506: INFRASTRUCTURE TOKEN THEFT

Type of Contribution

• New Technique
• New Mitigation

Checklist

• DCO sign-off included in commits (git commit -s)
• For technique contributions: see TEMPLATE-CHECKLIST.md
• For mitigation contributions: see TEMPLATE-CHECKLIST.md

Related Issues

Closes #[issue-number] (if applicable)

[arjunastha]

@bishnubista can you review this?

[bishnubista]

@blaycoder Please add version history

[blaycoder]

@blaycoder Please add version history

Noted
Thanks

[blaycoder]

@bishnubista Done

[bishnubista]

CRITICAL - Irrelevant arXiv Citation

The paper cited here (arxiv.org/html/2507.07974v1) is titled "Defending Against Prompt Injection With a Few DefensiveTokens" and is about a prompt injection defense mechanism, not about infrastructure token theft. This citation does not support the surrounding content about token exfiltration and should be removed or replaced with a relevant source on credential exfiltration from CI/CD systems.

[bishnubista]

CRITICAL - Technique Scope Mismatch with Registry

The README registry defines SAFE-T1506 as: "Steal OAuth/session tokens from logs, TLS termination proxies, or other infrastructure components where tokens may be inadvertently stored or exposed, then replay at intended service."

This PR describes a substantially broader attack (CI/CD secrets, cloud API keys, IAM, lateral movement across cloud environments). The content either needs to be scoped to match the registered description, or the registry entry needs to be updated as part of this PR.

[bishnubista]

CRITICAL - MITRE T1506 Does Not Exist

The SAFE technique is named SAFE-T1506 (a SAFE framework ID) but the document uses T1506 in the MITRE ATT&CK context within the example scenario (line 58: T1552, T1528). More importantly, T1506 is not a valid MITRE ATT&CK technique ID. The MITRE IDs actually referenced in the attack flow are T1552 (Unsecured Credentials) and T1528 (Steal Application Access Token). The SAFE-T1506 ID is fine as a SAFE-framework identifier, but authors should be careful not to imply it maps to a MITRE technique of the same number.

[bishnubista]

WARNING - Missing Required Overview Fields

The Overview section is missing two required fields from the template:

• **First Observed**: [Date/Not observed in production/Discovered by X]
• **Last Updated**: [Date]

Please add these fields to comply with the technique template.

[bishnubista]

WARNING - Detection Section Uses Wrong Heading

The template requires a ## Detection Methods heading (not ## Detection). Under it, the template requires two subsections:

1. ### Indicators of Compromise (IoCs) - currently missing; your log patterns and behavioral indicators should be organized under this heading
2. ### Detection Rules - with a Sigma rule embedded in a YAML code block

The ## Detection section in this PR lacks a Sigma detection rule entirely. All technique PRs require a detection-rule.yml file in the technique directory and an embedded Sigma rule in the README. Please add both.

[bishnubista]

WARNING - Mitigation Section Does Not Link to SAFE-M Controls

The template requires ## Mitigation Strategies (not ## Mitigation) with three subsections: ### Preventive Controls, ### Detective Controls, and ### Response Procedures. Each control should be linked to a specific SAFE-M mitigation, e.g.:

1. **[SAFE-M-3: Least Privilege](../../mitigations/SAFE-M-3/README.md)**: Implement RBAC...

The current free-form bullet list does not reference any SAFE mitigations. Please restructure and add cross-references to applicable mitigations.

[bishnubista]

WARNING - Missing Required Section: Related Techniques

The template requires a ## Related Techniques section that cross-references other SAFE techniques. For a token theft technique, relevant techniques might include credential access or reconnaissance techniques in the SAFE framework. Please add this section with links to at least 1-2 related SAFE techniques.

[bishnubista]

SAFE-MCP Automated Review Summary

PR: #182 - feat(SAFE-T1506): added [Infrastructure Token Theft]
Author: @blaycoder
Files changed: 1 (techniques/SAFE-T1506/README.md, +141 lines)

---

Comment Routing Stats

• Inline comments posted: 7 (3 critical, 4 warnings)
• Summarized below: additional context and info notes

---

Critical Issues (Must Fix Before Merge)

1. Irrelevant arXiv citation (line 123)
The paper arxiv.org/abs/2507.07974 ("Defending Against Prompt Injection With a Few DefensiveTokens") is about a prompt injection defense technique, not about infrastructure token theft or credential exfiltration. This is a mismatch between the cited source and the surrounding content. Remove it or replace it with a relevant source. See inline comment.

2. Technique scope mismatch with registry (line 5)
The README.md registry defines SAFE-T1506 narrowly as stealing OAuth/session tokens from TLS termination proxies and logs for replay attacks. This PR covers a much broader surface: CI/CD secrets, cloud API keys, IAM credentials, lateral movement. The PR content and the registry entry are misaligned. See inline comment.

3. MITRE T1506 does not exist (line 1)
T1506 is not a valid MITRE ATT&CK technique ID. The SAFE-T1506 identifier is a SAFE-framework ID (which is fine), but any implication that it maps to MITRE T1506 is incorrect. The actual MITRE techniques referenced in the attack flow are T1552 (Unsecured Credentials) and T1528 (Steal Application Access Token). Clarify this distinction in the document.

---

Warnings (Should Fix)

4. Missing required Overview fields (line 4)
The template requires First Observed and Last Updated fields in the Overview table. Both are absent.

5. Missing detection-rule.yml file
All technique submissions require a standalone detection-rule.yml file in the technique directory (see SAFE-T1001 through SAFE-T1006 for examples). This PR only includes README.md. The detection rule must also be embedded as a Sigma YAML block inside the README under ### Detection Rules.

6. Detection section structure does not match template (line 87)
The heading ## Detection should be ## Detection Methods. The subsection structure is also incorrect - missing ### Indicators of Compromise (IoCs) and ### Detection Rules (with embedded Sigma rule).

7. Mitigation section does not link to SAFE-M controls (line 113)
The heading ## Mitigation should be ## Mitigation Strategies with subsections ### Preventive Controls, ### Detective Controls, and ### Response Procedures. Each control should be linked to a SAFE-M mitigation document.

8. Missing Related Techniques section (line 130)
The template requires a ## Related Techniques section with links to other SAFE techniques. This section is entirely absent.

---

Template Compliance

Overall: 53.3% (8/15 required sections found)

Sections present: Overview, Description, Attack Vectors, Technical Details, Prerequisites, Attack Flow, Example Scenario, Impact, Detection (partial), Mitigation (partial), References, MITRE ATT&CK Mapping, Version History

Sections missing:

• First Observed / Last Updated fields in Overview
• Advanced Attack Techniques (optional but expected for a well-documented technique)
• Impact Assessment with Scope field (currently missing the Scope: Local/Adjacent/Network-wide line)
• Indicators of Compromise (IoCs) as a named subsection
• Detection Rules with embedded Sigma rule
• Mitigation Strategies with Preventive/Detective/Response subsections linked to SAFE-M controls
• Related Techniques section

---

Info Notes

• All 5 external URLs are reachable (200 OK): Microsoft Security Blog, CSI Corp, Permiso.io, CircleCI incident report, Palo Alto Networks
• The description of the attack is technically coherent and well-written
• The attack flow (Reconnaissance through Impact) is logically structured
• The CircleCI incident is a relevant and accurate real-world example
• MITRE techniques T1552, T1528, and T1078 are all applicable to the attack described
• The PR checklist shows DCO sign-off was not completed - contributors must include git commit -s

---

Recommendation

REQUEST CHANGES - There are 3 critical issues (irrelevant citation, scope mismatch with registry, non-existent MITRE ID reference) and 5 structural warnings. The most urgent fix is removing the arXiv reference to the prompt injection defense paper. The technique also requires a detection-rule.yml file and restructuring of the Detection and Mitigation sections to match the template.

See inline comments for line-specific guidance.

---

Automated review by SAFE-MCP pr-reviewer agent