Detectionlowtest

Github New Secret Created

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Muhammad FaisalCreated Fri Jan 20f9405037-bc97-4eb7-baba-167dad399b83application

Log Source

githubaudit

Productgithub← raw: github

Serviceaudit← raw: audit

Definition

Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming

Detection Logic

detection:
    selection:
        action:
            - 'codespaces.create_an_org_secret'
            - 'environment.create_actions_secret'
            - 'org.create_actions_secret'
            - 'repo.create_actions_secret'
    condition: selection

False Positives

This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the "actor".

References

Resolving title…

docs.github.com

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0003 · Persistence TA0004 · Privilege Escalation TA0001 · Initial Access

Sub-techniques

T1078.004 · Cloud Accounts

Rule Metadata

Rule ID

f9405037-bc97-4eb7-baba-167dad399b83

Status