Detection: GitHub Dependabot Alert

Updated Date: 2024-09-30 ID: 05032b04-4469-4034-9df7-05f607d75cba Author: Patrick Bareiss, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies the creation of GitHub Dependabot alerts, which indicate potential vulnerabilities in the codebase. It detects this activity by searching for logs with the "create" action and analyzing fields such as affected package, severity, and fixed version. This detection is significant for a SOC because it helps identify and address security risks in the codebase proactively. If confirmed malicious, these vulnerabilities could be exploited by attackers to gain unauthorized access or cause breaches, leading to potential data loss or system compromise.

1`github` alert.id=* action=create 
2| rename repository.full_name as repository, repository.html_url as repository_url sender.login as user 
3| stats min(_time) as firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range alert.created_at alert.external_identifier alert.external_reference alert.fixed_in alert.severity repository repository_url user 
4| eval phase="code" 
5| `security_content_ctime(firstTime)` 
6| `security_content_ctime(lastTime)` 
7| `github_dependabot_alert_filter`

Data Source

Name Platform Sourcetype Source
GitHub AWS icon AWS 'aws:firehose:json' 'github'

Macros Used

Name Value
github sourcetype=aws:firehose:json
github_dependabot_alert_filter search *
github_dependabot_alert_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1195.001 Compromise Software Dependencies and Development Tools Initial Access
T1195 Supply Chain Compromise Initial Access
KillChainPhase.DELIVERY
NistCategory.DE_AE
Cis18Value.CIS_13
Ember Bear
Sandworm Team

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.

Known False Positives

unknown

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
Vulnerabilities found in packages used by GitHub repository $repository$ 27 30 90
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset github aws:firehose:json
Integration ✅ Passing Dataset github aws:firehose:json

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3