Detection: GitHub Organizations Delete Branch Ruleset

Description

The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.

Search

 1`github_organizations` vendor_action=repository_ruleset.destroy
 2  
 3| fillnull
 4  
 5| stats count min(_time) as firstTime max(_time) as lastTime
 6    BY actor, actor_id, actor_ip,
 7       actor_is_bot, actor_location.country_code, business,
 8       business_id, org, org_id,
 9       repo, repo_id, user_agent,
10       vendor_action, ruleset_name
11  
12| eval user=actor
13  
14| `security_content_ctime(firstTime)`
15  
16| `security_content_ctime(lastTime)`
17  
18| `github_organizations_delete_branch_ruleset_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must ingest GitHub Organizations logs using Splunk Add-on for Github using a Personal Access Token https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/ .

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

• NPM Supply Chain Compromise

• GitHub Malicious Activity

Intermediate Findings

Threat Objects

References

• https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610

• https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10