Detection: Github Commit Changes In Master

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection deprecated as it no longer effectively identifies the intended malicious activity

Removed in version: 5.4.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: c9d2bfe2-019f-11ec-a8eb-acde48001122 Author: Teoderick Contreras, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects direct commits or pushes to the master or main branch in a GitHub repository. It leverages GitHub logs to identify events where changes are made directly to these critical branches. This activity is significant because direct modifications to the master or main branch bypass the standard review process, potentially introducing unreviewed and harmful changes. If confirmed malicious, this could lead to unauthorized code execution, security vulnerabilities, or compromised project integrity.

Search

1`github` branches{}.name = main OR branches{}.name = master 
2|  stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date repository.full_name 
3| rename commit.author.login as user, repository.full_name as repository 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `github_commit_changes_in_master_filter`

Data Source

Name	Platform	Sourcetype	Source
GitHub Webhooks	AWS	`'aws:firehose:json'`	`'github'`

Macros Used

Name	Value
github	`sourcetype=aws:firehose:json`
github_commit_changes_in_master_filter	``

github_commit_changes_in_master_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1199

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.

Known False Positives

Admin can do changes directly to master branch

Associated Analytic Story

Dev Sec Ops

References

https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5