Skip to content

Commit ce6a457

Browse files
author
Patrick Bareiss
committed
new github detections
1 parent aceab14 commit ce6a457

5 files changed

+236
-2
lines changed

‎detections/cloud/github_enterprise_remove_organization.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,6 @@ tags:
5454
required_fields:
5555
- actor
5656
- actor_id
57-
- actor_ip
5857
- actor_is_bot
5958
- actor_location.country_code
6059
- business

‎detections/cloud/github_enterprise_repository_archived.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: GitHub Enterprise Repository Archived
2+
id: 8367cb99-bae1-4748-ae3b-0927bb381424
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when a repository is archived in GitHub Enterprise.
9+
The detection monitors GitHub Enterprise audit logs for repository archival events by tracking actor details,
10+
repository information, and associated metadata. For a SOC, identifying repository archival is important as it could
11+
indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate
12+
feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt
13+
development operations. The impact of unauthorized repository archival includes loss of active development access, disruption
14+
to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived
15+
repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if
16+
proper backups are not maintained.
17+
data_source:
18+
- GitHub Enterprise Audit Logs
19+
search: '`github_enterprise` action=repo.archived
20+
| fillnull
21+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, visibility, action
22+
| eval user=actor
23+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `github_enterprise_repository_deleted_filter`'
25+
how_to_implement: You must ingest GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
26+
known_false_positives: unknown
27+
references:
28+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
29+
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
30+
drilldown_searches:
31+
- name: View the detection results for - "$user$"
32+
search: '%original_detection_search% | search user = "$user$"'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: View risk events for the last 7 days for - "$user$"
36+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
tags:
40+
analytic_story:
41+
- GitHub Malicious Activity
42+
asset_type: GitHub
43+
confidence: 90
44+
impact: 30
45+
message: $user$ archived a repository in GitHub Enterprise
46+
mitre_attack_id:
47+
- T1485
48+
observable:
49+
- name: user
50+
type: User
51+
role:
52+
- Victim
53+
product:
54+
- Splunk Enterprise
55+
- Splunk Enterprise Security
56+
- Splunk Cloud
57+
required_fields:
58+
- actor
59+
- actor_id
60+
- actor_is_bot
61+
- actor_location.country_code
62+
- business
63+
- business_id
64+
- org
65+
- org_id
66+
- repo
67+
- repo_id
68+
- user_agent
69+
risk_score: 27
70+
security_domain: network
71+
tests:
72+
- name: True Positive Test
73+
attack_data:
74+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/github_archived_repository/github.json
75+
source: http:github
76+
sourcetype: httpevent
77+
78+

‎detections/cloud/github_enterprise_repository_deleted.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,6 @@ tags:
5454
required_fields:
5555
- actor
5656
- actor_id
57-
- actor_ip
5857
- actor_is_bot
5958
- actor_location.country_code
6059
- business

‎detections/cloud/github_organizations_repository_archived.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: GitHub Organizations Repository Archived
2+
id: 4f568a0e-896f-4d94-a2f7-fa6d82ab1f77
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic detects when a repository is archived in GitHub Organizations.
9+
The detection monitors GitHub Organizations audit logs for repository archival events by tracking actor details,
10+
repository information, and associated metadata. For a SOC, identifying repository archival is important as it could
11+
indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate
12+
feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt
13+
development operations. The impact of unauthorized repository archival includes loss of active development access, disruption
14+
to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived
15+
repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if
16+
proper backups are not maintained.
17+
data_source:
18+
- GitHub Organizations Audit Logs
19+
search: '`github_organizations` vendor_action=repo.archived
20+
| fillnull
21+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, visibility, vendor_action
22+
| eval user=actor
23+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `github_organizations_repository_deleted_filter`'
25+
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs .
26+
known_false_positives: unknown
27+
references:
28+
- https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs
29+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
30+
drilldown_searches:
31+
- name: View the detection results for - "$user$"
32+
search: '%original_detection_search% | search user = "$user$"'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: View risk events for the last 7 days for - "$user$"
36+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
tags:
40+
analytic_story:
41+
- GitHub Malicious Activity
42+
asset_type: GitHub
43+
confidence: 90
44+
impact: 30
45+
message: $user$ archived a repository in GitHub Organizations
46+
mitre_attack_id:
47+
- T1485
48+
observable:
49+
- name: user
50+
type: User
51+
role:
52+
- Victim
53+
product:
54+
- Splunk Enterprise
55+
- Splunk Enterprise Security
56+
- Splunk Cloud
57+
required_fields:
58+
- actor
59+
- actor_id
60+
- actor_is_bot
61+
- actor_location.country_code
62+
- business
63+
- business_id
64+
- org
65+
- org_id
66+
- repo
67+
- repo_id
68+
- user
69+
- user_agent
70+
- user_id
71+
risk_score: 27
72+
security_domain: network
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/github_archived_repository/github.json
77+
source: github
78+
sourcetype: github:cloud:audit
79+

‎detections/cloud/github_organizations_repository_deleted.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: GitHub Organizations Repository Deleted
2+
id: 9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71
3+
version: 1
4+
date: '2025-01-17'
5+
author: Patrick Bareiss, Splunk
6+
status: production
7+
type: Anomaly
8+
description: The following analytic identifies when a repository is deleted within a GitHub organization.
9+
The detection monitors GitHub Organizations audit logs for repository deletion events by tracking actor details,
10+
repository information, and associated metadata. This behavior is concerning for SOC teams as malicious actors may
11+
attempt to delete repositories to destroy source code, intellectual property, or evidence of compromise. Repository
12+
deletion can result in permanent loss of code, documentation, and project history if proper backups are not maintained.
13+
Additionally, unauthorized repository deletion could indicate account compromise, insider threats, or attempts to disrupt
14+
business operations. The impact of a repository deletion attack includes loss of intellectual property, disruption to
15+
development workflows, and potential financial losses from lost work. Early detection of unauthorized repository deletions
16+
allows security teams to investigate potential compromises and restore from backups if needed.
17+
data_source:
18+
- GitHub Organizations Audit Logs
19+
search: '`github_organizations` vendor_action=repo.destroy
20+
| fillnull
21+
| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, visibility, vendor_action
22+
| eval user=actor
23+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `github_organizations_repository_deleted_filter`'
25+
how_to_implement: You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs .
26+
known_false_positives: unknown
27+
references:
28+
- https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs
29+
- https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
30+
drilldown_searches:
31+
- name: View the detection results for - "$user$"
32+
search: '%original_detection_search% | search user = "$user$"'
33+
earliest_offset: $info_min_time$
34+
latest_offset: $info_max_time$
35+
- name: View risk events for the last 7 days for - "$user$"
36+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
tags:
40+
analytic_story:
41+
- GitHub Malicious Activity
42+
asset_type: GitHub
43+
confidence: 90
44+
impact: 30
45+
message: $user$ deleted a repository in GitHub Organizations
46+
mitre_attack_id:
47+
- T1485
48+
observable:
49+
- name: user
50+
type: User
51+
role:
52+
- Victim
53+
product:
54+
- Splunk Enterprise
55+
- Splunk Enterprise Security
56+
- Splunk Cloud
57+
required_fields:
58+
- actor
59+
- actor_id
60+
- actor_is_bot
61+
- actor_location.country_code
62+
- business
63+
- business_id
64+
- org
65+
- org_id
66+
- repo
67+
- repo_id
68+
- user
69+
- user_agent
70+
- user_id
71+
risk_score: 27
72+
security_domain: network
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/github_delete_repository/github.json
77+
source: github
78+
sourcetype: github:cloud:audit
79+

0 commit comments

Comments
 (0)