Skip to content

Commit c1c4595

Browse files
author
Patrick Bareiss
committed
new detections
1 parent 5552843 commit c1c4595

4 files changed

+316
-0
lines changed

‎detections/cloud/github_enterprise_delete_branch_ruleset.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: GitHub Enterprise Delete Branch Ruleset
2+
id: 6169ea23-3719-439f-957a-0ea5174b70e2
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when branch rules are deleted in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying deleted branch rules is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch deletion rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of
13+
disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise
14+
of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting
15+
to inject malicious code.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=repository_ruleset.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, action, ruleset_name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_delete_branch_ruleset_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- GitHub Malicious Activity
41+
asset_type: GitHub
42+
confidence: 90
43+
impact: 30
44+
message: $user$ deleted a branch ruleset in repo $repo$
45+
mitre_attack_id:
46+
- T1562.001
47+
observable:
48+
- name: user
49+
type: User
50+
role:
51+
- Victim
52+
product:
53+
- Splunk Enterprise
54+
- Splunk Enterprise Security
55+
- Splunk Cloud
56+
required_fields:
57+
- actor
58+
- actor_id
59+
- actor_is_bot
60+
- actor_location.country_code
61+
- business
62+
- business_id
63+
- org
64+
- org_id
65+
- repo
66+
- repo_id
67+
- user_agent
68+
- ruleset_name
69+
risk_score: 27
70+
security_domain: network
71+
tests:
72+
- name: True Positive Test
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github.json
75+
source: http:github
76+
sourcetype: httpevent
77+
78+

‎detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: GitHub Enterprise Disable Classic Branch Protection Rule
2+
id: 372176ba-450c-4abd-9b86-419bb44c1b76
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for branch protection removal events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of
13+
disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise
14+
of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting
15+
to inject malicious code.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=protected_branch.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, action, name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_disable_classic_branch_protection_rule_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- GitHub Malicious Activity
41+
asset_type: GitHub
42+
confidence: 90
43+
impact: 30
44+
message: $user$ disabled a classic branch protection rule in repo $repo$
45+
mitre_attack_id:
46+
- T1562.001
47+
observable:
48+
- name: user
49+
type: User
50+
role:
51+
- Victim
52+
product:
53+
- Splunk Enterprise
54+
- Splunk Enterprise Security
55+
- Splunk Cloud
56+
required_fields:
57+
- actor
58+
- actor_id
59+
- actor_is_bot
60+
- actor_location.country_code
61+
- business
62+
- business_id
63+
- org
64+
- org_id
65+
- repo
66+
- repo_id
67+
- user_agent
68+
- name
69+
risk_score: 27
70+
security_domain: network
71+
tests:
72+
- name: True Positive Test
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github.json
75+
source: http:github
76+
sourcetype: httpevent
77+
78+

‎detections/cloud/github_organizations_delete_branch_ruleset.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: GitHub Organizations Delete Branch Ruleset
2+
id: 8e454f64-4bd6-45e6-8a94-1b482593d721
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when branch rulesets are deleted in GitHub Organizations.
9+
The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches.
13+
The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code,
14+
and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls
15+
before attempting to inject malicious code.
16+
data_source:
17+
- GitHub Organizations Audit Logs
18+
search: '`github_organizations` vendor_action=repository_ruleset.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, vendor_action, ruleset_name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_organizations_delete_branch_ruleset_filter`'
24+
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs .
25+
known_false_positives: unknown
26+
references:
27+
- https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs
28+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- GitHub Malicious Activity
41+
asset_type: GitHub
42+
confidence: 90
43+
impact: 30
44+
message: $user$ deleted a branch ruleset in repo $repo$
45+
mitre_attack_id:
46+
- T1562.001
47+
observable:
48+
- name: user
49+
type: User
50+
role:
51+
- Victim
52+
product:
53+
- Splunk Enterprise
54+
- Splunk Enterprise Security
55+
- Splunk Cloud
56+
required_fields:
57+
- actor
58+
- actor_id
59+
- actor_ip
60+
- actor_is_bot
61+
- actor_location.country_code
62+
- business
63+
- business_id
64+
- org
65+
- org_id
66+
- repo
67+
- repo_id
68+
- user
69+
- user_agent
70+
- user_id
71+
- name
72+
risk_score: 27
73+
security_domain: network
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github.json
78+
source: github
79+
sourcetype: github:cloud:audit
80+

‎detections/cloud/github_organizations_disable_classic_branch_protection_rule..yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: GitHub Organizations Disable Classic Branch Protection Rule
2+
id: 33cffee0-41ee-402e-a238-d37825f2d788
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when classic branch protection rules are disabled in GitHub Organizations.
9+
The detection monitors GitHub Organizations audit logs for branch protection removal events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches.
13+
The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities
14+
or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary
15+
first disables security controls before attempting to inject malicious code.
16+
data_source:
17+
- GitHub Organizations Audit Logs
18+
search: '`github_organizations` vendor_action=protected_branch.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, vendor_action, name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_organizations_disable_classic_branch_protection_rule_filter`'
24+
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs .
25+
known_false_positives: unknown
26+
references:
27+
- https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs
28+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- GitHub Malicious Activity
41+
asset_type: GitHub
42+
confidence: 90
43+
impact: 30
44+
message: $user$ disabled a classic branch protection rule in repo $repo$
45+
mitre_attack_id:
46+
- T1562.001
47+
observable:
48+
- name: user
49+
type: User
50+
role:
51+
- Victim
52+
product:
53+
- Splunk Enterprise
54+
- Splunk Enterprise Security
55+
- Splunk Cloud
56+
required_fields:
57+
- actor
58+
- actor_id
59+
- actor_ip
60+
- actor_is_bot
61+
- actor_location.country_code
62+
- business
63+
- business_id
64+
- org
65+
- org_id
66+
- repo
67+
- repo_id
68+
- user
69+
- user_agent
70+
- user_id
71+
- name
72+
risk_score: 27
73+
security_domain: network
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github.json
78+
source: github
79+
sourcetype: github:cloud:audit
80+

0 commit comments

Comments
 (0)