Skip to content

Commit c9a144b

Browse files
ljstellaljstella
committed
Merge branch 'develop' into manual-ta-update-188
2 parents 1583900 + a810c4e commit c9a144b

30 files changed

+1292
-24
lines changed

‎contentctl.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,13 @@ apps:
213213
version: 4.2.2
214214
description: PSC for MLTK
215215
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/python-for-scientific-computing-for-linux-64-bit_422.tgz
216-
- uid: 2882
216+
- uid: 6254
217+
title: Splunk Add-on for Github
218+
appid: Splunk_TA_github
219+
version: 3.1.0
220+
description: description of app
221+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-github_310.tgz
222+
- uid: 2882
217223
title: Splunk Add-on for AppDynamics
218224
appid: Splunk_TA_AppDynamics
219225
version: 3.0.0

‎data_sources/github_enterprise_audit_logs.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: GitHub Enterprise Audit Logs
2+
id: 8a4d656f-8801-4a2c-ae10-553d2696a59f
3+
version: 1
4+
date: '2025-01-15'
5+
author: Patrick Bareiss, Splunk
6+
description: Data source object for GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
7+
source: http:github
8+
sourcetype: httpevent
9+
supported_TA:
10+
- name: Splunk Add-on for Github
11+
url: https://splunkbase.splunk.com/app/6254
12+
version: 3.1.0
13+
fields:
14+
- _document_id
15+
- action
16+
- actor
17+
- actor_id
18+
- actor_is_bot
19+
- business
20+
- business_id
21+
- created_at
22+
- operation_type
23+
- org
24+
- org_id
25+
- public_repo
26+
- repo
27+
- repo_id
28+
- request_access_security_header
29+
- user
30+
- user_agent
31+
- user_id
32+
example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }'

‎data_sources/github_organizations_audit_logs.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: GitHub Organizations Audit Logs
2+
id: ce520b1c-79fe-48ef-a0f9-71fbbd4837b0
3+
version: 1
4+
date: '2025-01-15'
5+
author: Patrick Bareiss, Splunk
6+
description: Data source object for GitHub Organizations logs using the Splunk Add-on for Github using a Personal Access Token.
7+
source: github
8+
sourcetype: github:cloud:audit
9+
supported_TA:
10+
- name: Splunk Add-on for Github
11+
url: https://splunkbase.splunk.com/app/6254
12+
version: 3.1.0
13+
fields:
14+
- _document_id
15+
- action
16+
- actor
17+
- actor_id
18+
- actor_is_bot
19+
- business
20+
- business_id
21+
- created_at
22+
- operation_type
23+
- org
24+
- org_id
25+
- public_repo
26+
- repo
27+
- repo_id
28+
- request_access_security_header
29+
- user
30+
- user_agent
31+
- user_id
32+
example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }'

‎data_sources/github.yml‎ renamed to ‎data_sources/github_webhooks.yml‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,12 @@
1-
name: GitHub
1+
name: GitHub Webhooks
22
id: 88aa4632-3c3e-43f6-a00a-998d71f558e3
33
version: 1
44
date: '2024-07-18'
55
author: Patrick Bareiss, Splunk
6-
description: Data source object for GitHub
6+
description: Data source object for GitHub Webooks
77
source: github
88
sourcetype: aws:firehose:json
9-
supported_TA:
10-
- name: Splunk Add-on for Github
11-
url: https://splunkbase.splunk.com/app/6254
12-
version: 3.1.0
9+
supported_TA: []
1310
fields:
1411
- _time
1512
- action

‎detections/cloud/github_enterprise_delete_branch_ruleset.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: GitHub Enterprise Delete Branch Ruleset
2+
id: 6169ea23-3719-439f-957a-0ea5174b70e2
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when branch rules are deleted in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for branch rule deletion events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying deleted branch rules is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch deletion rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of
13+
disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise
14+
of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting
15+
to inject malicious code.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=repository_ruleset.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, action, ruleset_name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_delete_branch_ruleset_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: $user$ deleted a branch ruleset in repo $repo$
40+
risk_objects:
41+
- field: user
42+
type: user
43+
score: 25
44+
threat_objects:
45+
- field: user_agent
46+
type: http_user_agent
47+
tags:
48+
analytic_story:
49+
- GitHub Malicious Activity
50+
asset_type: GitHub
51+
mitre_attack_id:
52+
- T1562.001
53+
- T1195
54+
product:
55+
- Splunk Enterprise
56+
- Splunk Enterprise Security
57+
- Splunk Cloud
58+
security_domain: network
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github.json
63+
source: http:github
64+
sourcetype: httpevent
65+
66+

‎detections/cloud/github_enterprise_disable_2fa_requirement.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: GitHub Enterprise Disable 2FA Requirement
2+
id: 5a773226-ebd7-480c-a819-fccacfeddcd9
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when two-factor authentication (2FA) requirements are disabled in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for 2FA requirement changes by tracking actor details, organization information,
10+
and associated metadata. For a SOC, identifying disabled 2FA requirements is critical as it could indicate attempts to weaken
11+
account security controls. Two-factor authentication is a fundamental security control that helps prevent unauthorized access even if
12+
passwords are compromised. Disabling 2FA requirements could allow attackers to more easily compromise accounts through password-based attacks.
13+
The impact of disabled 2FA includes increased risk of account takeover, potential access to sensitive code and intellectual property, and
14+
compromise of the software supply chain. This activity could be part of a larger attack chain where an adversary first disables
15+
security controls before attempting broader account compromises.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=org.disable_two_factor_requirement OR action=business.disable_two_factor_requirement
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, user_agent, action
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_disable_2fa_requirement_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: $user$ disabled 2FA requirement
40+
risk_objects:
41+
- field: user
42+
type: user
43+
score: 25
44+
threat_objects:
45+
- field: user_agent
46+
type: http_user_agent
47+
tags:
48+
analytic_story:
49+
- GitHub Malicious Activity
50+
asset_type: GitHub
51+
mitre_attack_id:
52+
- T1562.001
53+
- T1195
54+
product:
55+
- Splunk Enterprise
56+
- Splunk Enterprise Security
57+
- Splunk Cloud
58+
security_domain: network
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/github.json
63+
source: http:github
64+
sourcetype: httpevent

‎detections/cloud/github_enterprise_disable_audit_log_event_stream.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: GitHub Enterprise Disable Audit Log Event Stream
2+
id: 7bc111cc-7f1b-4be7-99fa-50cf8d2e7564
3+
version: 1
4+
date: '2025-01-16'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when a user disables audit log event streaming in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for configuration changes that disable the audit log streaming functionality,
10+
which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent
11+
their malicious activities from being logged and detected by disabling the audit trail. For a SOC, identifying the disabling of
12+
audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could
13+
be severe as organizations lose visibility into user actions, configuration changes, and security events within their
14+
GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection.
15+
This creates a significant blind spot in security monitoring and incident response capabilities.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=audit_log_streaming.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, user_agent, action
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_disable_audit_log_event_stream_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: Audit log event streaming is disabled by $user$
40+
risk_objects:
41+
- field: user
42+
type: user
43+
score: 25
44+
threat_objects:
45+
- field: user_agent
46+
type: http_user_agent
47+
tags:
48+
analytic_story:
49+
- GitHub Malicious Activity
50+
asset_type: GitHub
51+
mitre_attack_id:
52+
- T1562.008
53+
- T1195
54+
product:
55+
- Splunk Enterprise
56+
- Splunk Enterprise Security
57+
- Splunk Cloud
58+
security_domain: network
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/github.json
63+
source: http:github
64+
sourcetype: httpevent
65+

‎detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: GitHub Enterprise Disable Classic Branch Protection Rule
2+
id: 372176ba-450c-4abd-9b86-419bb44c1b76
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for branch protection removal events by tracking actor details, repository information,
10+
and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements
11+
and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality.
12+
Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of
13+
disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise
14+
of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting
15+
to inject malicious code.
16+
data_source:
17+
- GitHub Enterprise Audit Logs
18+
search: '`github_enterprise` action=protected_branch.destroy
19+
| fillnull
20+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, action, name
21+
| eval user=actor
22+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `github_enterprise_disable_classic_branch_protection_rule_filter`'
24+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
25+
known_false_positives: unknown
26+
references:
27+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
28+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
rba:
39+
message: $user$ disabled a classic branch protection rule in repo $repo$
40+
risk_objects:
41+
- field: user
42+
type: user
43+
score: 25
44+
threat_objects:
45+
- field: user_agent
46+
type: http_user_agent
47+
tags:
48+
analytic_story:
49+
- GitHub Malicious Activity
50+
asset_type: GitHub
51+
mitre_attack_id:
52+
- T1562.001
53+
- T1195
54+
product:
55+
- Splunk Enterprise
56+
- Splunk Enterprise Security
57+
- Splunk Cloud
58+
security_domain: network
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github.json
63+
source: http:github
64+
sourcetype: httpevent
65+
66+

0 commit comments

Comments
 (0)