Skip to content

Commit 8ef62a2

Browse files
author
Patrick Bareiss
committed
new detections
1 parent 71efc6a commit 8ef62a2

File tree

2 files changed

+144
-0
lines changed

2 files changed

+144
-0
lines changed

‎detections/cloud/github_enterprise_created_self_hosted_runner.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: GitHub Enterprise Created Self Hosted Runner
2+
id: b27685a2-8826-4123-ab78-2d9d0d419ed0
3+
version: 1
4+
date: '2025-01-20'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies when a self-hosted runner is created in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for actions related to creating new self-hosted runners at the organization or enterprise level.
10+
his behavior warrants monitoring because self-hosted runners execute workflow jobs on customer-controlled infrastructure, which could be exploited by attackers to
11+
execute malicious code, access sensitive data, or pivot to other systems. While self-hosted runners are a legitimate feature, their creation should be carefully
12+
controlled as compromised runners pose significant security risks. The impact includes potential remote code execution, data exfiltration, and lateral movement
13+
within the environment if a runner is compromised. SOC teams should investigate unexpected runner creation events to verify they are authorized and properly secured,
14+
especially if created by unfamiliar users or in unusual contexts.
15+
data_source:
16+
- GitHub Enterprise Audit Logs
17+
search: '`github_enterprise` action=enterprise.register_self_hosted_runner
18+
| fillnull
19+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, user_agent, action
20+
| eval user=actor
21+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
22+
| `github_enterprise_disabled_ip_allow_list_filter`'
23+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
24+
known_false_positives: unknown
25+
references:
26+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
27+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
28+
drilldown_searches:
29+
- name: View the detection results for - "$user$"
30+
search: '%original_detection_search% | search user = "$user$"'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
- name: View risk events for the last 7 days for - "$user$"
34+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
tags:
38+
analytic_story:
39+
- GitHub Malicious Activity
40+
asset_type: GitHub
41+
confidence: 90
42+
impact: 30
43+
message: $user$ created a self-hosted runner in GitHub Enterprise
44+
mitre_attack_id:
45+
- T1562.001
46+
observable:
47+
- name: user
48+
type: User
49+
role:
50+
- Victim
51+
product:
52+
- Splunk Enterprise
53+
- Splunk Enterprise Security
54+
- Splunk Cloud
55+
required_fields:
56+
- actor
57+
- actor_id
58+
- actor_is_bot
59+
- actor_location.country_code
60+
- business
61+
- business_id
62+
- user_agent
63+
risk_score: 27
64+
security_domain: network
65+
tests:
66+
- name: True Positive Test
67+
attack_data:
68+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/github.json
69+
source: http:github
70+
sourcetype: httpevent
71+
72+

‎detections/cloud/github_enterprise_disabled_ip_allow_list.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: GitHub Enterprise Disable IP Allow List
2+
id: afed020e-edcd-4913-a675-cebedf81d4fb
3+
version: 1
4+
date: '2025-01-20'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies when an IP allow list is disabled in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for actions related to disabling IP allow lists at the organization or enterprise level.
10+
This behavior is concerning because IP allow lists are a critical security control that restricts access to GitHub Enterprise resources to only
11+
trusted IP addresses. When disabled, it could indicate an attacker attempting to bypass access controls to gain unauthorized access from untrusted
12+
networks. The impact includes potential exposure of sensitive code repositories and GitHub Enterprise resources to access from any IP address.
13+
SOC teams should investigate such events, especially if they were not pre-approved changes, as they may indicate compromise of admin credentials
14+
or malicious insider activity.
15+
data_source:
16+
- GitHub Enterprise Audit Logs
17+
search: '`github_enterprise` action=ip_allow_list.disable
18+
| fillnull
19+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, user_agent, user_id, action
20+
| eval user=actor
21+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
22+
| `github_enterprise_disabled_ip_allow_list_filter`'
23+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
24+
known_false_positives: unknown
25+
references:
26+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
27+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
28+
drilldown_searches:
29+
- name: View the detection results for - "$user$"
30+
search: '%original_detection_search% | search user = "$user$"'
31+
earliest_offset: $info_min_time$
32+
latest_offset: $info_max_time$
33+
- name: View risk events for the last 7 days for - "$user$"
34+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
35+
earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
tags:
38+
analytic_story:
39+
- GitHub Malicious Activity
40+
asset_type: GitHub
41+
confidence: 90
42+
impact: 30
43+
message: $user$ disabled an IP allow list in GitHub Enterprise
44+
mitre_attack_id:
45+
- T1562.001
46+
observable:
47+
- name: user
48+
type: User
49+
role:
50+
- Victim
51+
product:
52+
- Splunk Enterprise
53+
- Splunk Enterprise Security
54+
- Splunk Cloud
55+
required_fields:
56+
- actor
57+
- actor_id
58+
- actor_is_bot
59+
- actor_location.country_code
60+
- business
61+
- business_id
62+
- user_agent
63+
risk_score: 27
64+
security_domain: network
65+
tests:
66+
- name: True Positive Test
67+
attack_data:
68+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/github.json
69+
source: http:github
70+
sourcetype: httpevent
71+
72+

0 commit comments

Comments
 (0)