ID | Technique | Tactic |
---|---|---|
T1562.001 | Disable or Modify Tools | Defense Evasion |
T1195 | Supply Chain Compromise | Initial Access |
Detection: GitHub Organizations Delete Branch Ruleset
Description
The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
Search
1`github_organizations` vendor_action=repository_ruleset.destroy
2| fillnull
3| stats count min(_time) as firstTime max(_time) as lastTime by actor, actor_id, actor_ip, actor_is_bot, actor_location.country_code, business, business_id, org, org_id, repo, repo_id, user_agent, vendor_action, ruleset_name
4| eval user=actor
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `github_organizations_delete_branch_ruleset_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
GitHub Organizations Audit Logs | N/A | 'github:cloud:audit' |
'github' |
Macros Used
Name | Value |
---|---|
github_organizations | sourcetype=github:cloud:audit |
github_organizations_delete_branch_ruleset_filter | search * |
github_organizations_delete_branch_ruleset_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://docs.splunk.com/Documentation/AddOns/released/GitHub/Configureinputs .
Known False Positives
unknown
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message:
$user$ deleted a branch ruleset in repo $repo$
Risk Object | Risk Object Type | Risk Score | Threat Objects |
---|---|---|---|
user | user | 25 | user_agent |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | github |
github:cloud:audit |
Integration | ✅ Passing | Dataset | github |
github:cloud:audit |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1