Detection rules for GitHub Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 13 detection rules.

Rule Example

Below is an example of a rule definition for GitHub Action Secret Access Activity (view in repository):

# Rule version v1.0.0

dataTypes:
  - github
name: GitHub Action Secret Access Activity
impact:
  confidentiality: 3
  integrity: 3
  availability: 1
category: Collection
technique: "T1552 - Unsecured Credentials"
adversary: origin
references:
  - https://docs.github.com/en/actions/security-guides/encrypted-secrets
  - https://attack.mitre.org/techniques/T1552/
description: |
  Detects access, modification, or suspicious activities related to GitHub Action secrets. This could indicate attempts to steal credentials, API keys, or other sensitive information stored in repository or organization secrets.
  
  Next Steps:
  1. Review the GitHub audit logs to identify who accessed or modified the secrets
  2. Check if the user performing the action has legitimate business need for secret access
  3. Verify if any secrets were exposed in workflow logs or outputs
  4. Rotate any potentially compromised secrets immediately
  5. Review repository and organization permissions to ensure proper access controls
  6. Check for any unusual API calls or automated scripts accessing secrets
  7. Enable secret scanning alerts if not already configured
  8. Consider implementing additional controls like environment-specific secrets and approval workflows
where: |
  oneOf("log.action", ["secret.create", "secret.update", "secret.remove"]) ||
  oneOf("log.action", ["actions.secret.create", "actions.secret.update", "actions.secret.remove", "dependabot.secret.create", "dependabot.secret.update", "dependabot.secret.remove"])
afterEvents:
  - indexPattern: v1-7-22-log-github-*
    with:
      - field: log.repositoryName
        operator: filter_term
        value: '{{.log.repositoryName}}'
      - field: log.action
        operator: filter_match
        value: secret
    within: now-1h
    count: 3
groupBy:
  - lastEvent.log.action
  - lastEvent.log.repositoryName
  - lastEvent.log.senderLogin

Rule Details

GitHub Action Secret Access Activity

Identifies access, changes, or suspicious behavior involving GitHub Action secrets. This may point to efforts to steal credentials, API keys, or other sensitive data kept in repository or organization secrets.

• Category: Collection

• Technique: T1552 - Unsecured Credentials

• Impact: C:3 / I:3 / A:1

• Rule file: action_secret_access.yml

• Reference: https://docs.github.com/en/actions/security-guides/encrypted-secrets

• Reference: https://attack.mitre.org/techniques/T1552/

GitHub App Installation Token Suspicious Access

Identifies suspicious GitHub App installation and token activity originating from unexpected sources. Attackers who obtain GitHub App private keys can create installation tokens for any organization with the app installed, gaining wide access to repositories.

• Category: Credential Access

• Technique: T1528 - Steal Application Access Token

• Impact: C:2 / I:2 / A:1

• Rule file: github_app_token_theft.yml

• Reference: https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app

• Reference: https://attack.mitre.org/techniques/T1528/

GitHub CODEOWNERS File Modification

Identifies changes to CODEOWNERS files, which set required reviewers for code changes. Attackers might alter CODEOWNERS to eliminate review requirements for sensitive paths, allowing them to merge malicious code without appropriate review.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:2 / I:3 / A:1

• Rule file: codeowners_modification.yml

• Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners

• Reference: https://attack.mitre.org/techniques/T1562/001/

GitHub Dependabot Configuration Poisoning

Identifies changes to dependabot.yml configuration files that could point dependency updates to malicious registries or add malicious packages. Attackers might alter the Dependabot configuration to replace legitimate dependencies with malicious ones.

• Category: Supply Chain Compromise

• Technique: T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain

• Impact: C:2 / I:3 / A:1

• Rule file: dependabot_config_poisoning.yml

• Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates

• Reference: https://attack.mitre.org/techniques/T1195/002/

GitHub Environment Protection Rule Bypass

Identifies changes to GitHub environment protection rules, such as removing required reviewers, wait timers, or branch restrictions. Attackers might alter these protections to deploy malicious code to production environments without approval.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:2 / I:3 / A:1

• Rule file: environment_protection_bypass.yml

• Reference: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment

• Reference: https://attack.mitre.org/techniques/T1562/001/

GitHub Mass Repository Cloning Detection

Identifies when several repositories are cloned or accessed within a brief time frame, which may signal data exfiltration or reconnaissance. This rule watches for repository access patterns that go beyond normal user behavior, possibly indicating an insider threat or a compromised account trying to steal source code.

• Category: Collection

• Technique: T1213 - Data from Information Repositories

• Impact: C:3 / I:2 / A:1

• Rule file: mass_repository_cloning.yml

• Reference: https://docs.github.com/en/webhooks/webhook-events-and-payloads#push

• Reference: https://attack.mitre.org/techniques/T1213/

GitHub Organization Member to Owner Role Escalation

Identifies privilege escalation of GitHub organization member roles from member to owner. Organization owners possess full administrative access, including managing billing, teams, repositories, and security settings. Unauthorized role escalation can result in total organizational compromise.

• Category: Privilege Escalation

• Technique: T1098 - Account Manipulation

• Impact: C:3 / I:3 / A:2

• Rule file: org_member_role_escalation.yml

• Reference: https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization

• Reference: https://attack.mitre.org/techniques/T1098/

GitHub Repository Visibility Changed to Public

Identifies when a private repository's visibility is changed to public, which may expose proprietary source code, credentials, and sensitive configuration. This is a critical event that can result in data exposure and intellectual property theft.

• Category: Data Exfiltration

• Technique: T1537 - Transfer Data to Cloud Account

• Impact: C:3 / I:2 / A:1

• Rule file: repo_visibility_public.yml

• Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility

• Reference: https://attack.mitre.org/techniques/T1537/

GitHub Secret Scanning Alert Detected

Identifies when GitHub's secret scanning feature finds possible secrets, API keys, or credentials committed to a repository. This may indicate accidental exposure of sensitive information that attackers could exploit.

• Category: Credential Access

• Technique: T1552: Unsecured Credentials

• Impact: C:3 / I:2 / A:1

• Rule file: secret_scanning_alerts.yml

• Reference: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

• Reference: https://attack.mitre.org/techniques/T1552/

GitHub Self-Hosted Runner Compromise Detection

Identifies suspicious self-hosted runner operations, such as unexpected runner registration, deregistration, or workflows that specifically target self-hosted runners. Compromised self-hosted runners can grant access to the internal network and secrets stored on the runner machine.

• Category: Supply Chain Compromise

• Technique: T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain

• Impact: C:3 / I:3 / A:2

• Rule file: self_hosted_runner_compromise.yml

• Reference: https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners

• Reference: https://attack.mitre.org/techniques/T1195/002/

GitHub Sensitive Data Commit Detection

Identifies commits that may hold sensitive data, including API keys, passwords, private keys, or other credentials, based on commit message patterns or file names.

• Category: Collection

• Technique: T1074 - Data Staged

• Impact: C:3 / I:2 / A:1

• Rule file: sensitive_data_commits.yml

• Reference: https://docs.github.com/en/webhooks/webhook-events-and-payloads#push

• Reference: https://attack.mitre.org/techniques/T1074/

GitHub Workflow Modifications Detected

Identifies changes to GitHub Actions workflows that could be used to insert malicious code into the CI/CD pipeline or steal secrets. Attackers might alter workflows to run arbitrary code, exfiltrate secrets, or compromise the software supply chain.

• Category: Initial Access

• Technique: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools

• Impact: C:3 / I:3 / A:2

• Rule file: workflow_modifications.yml

• Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows

• Reference: https://attack.mitre.org/techniques/T1195/001/

GitHub Workflow pull_request_target Injection

Identifies alterations to GitHub Actions workflow files that could enable abuse of the pull_request_target trigger. Even on forked PRs, this trigger runs with repository write permissions and access to secrets, making it a high-value target for supply chain attacks.

• Category: Supply Chain Compromise

• Technique: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools

• Impact: C:3 / I:3 / A:1

• Rule file: workflow_injection_pr_target.yml

• Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

• Reference: https://attack.mitre.org/techniques/T1195/001/