security_content/removed/detections/github_actions_disable_security_workflow.yml at develop · devhhu/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: GitHub Actions Disable Security Workflow
id: 0459f1a5-c0ac-4987-82d6-65081209f854
version: 6
date: '2025-02-10'
author: Patrick Bareiss, Splunk
status: removed
type: Anomaly
description: The following analytic detects the disabling of a security workflow in
  GitHub Actions. It leverages GitHub logs to identify when a workflow, excluding
  those named *security-testing*, is disabled following a push or pull request event.
  This activity is significant as it may indicate an attempt by an attacker to conceal
  malicious code by disabling security checks. If confirmed malicious, this could
  allow the attacker to introduce and persist undetected malicious code within the
  repository, potentially compromising the integrity and security of the codebase.
data_source:
- GitHub Webhooks
search: '`github` workflow_run.event=push OR workflow_run.event=pull_request | stats
  values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event
  workflow_run.head_branch workflow_run.head_commit.author.email workflow_run.head_commit.author.name
  workflow_run.head_commit.message workflow_run.head_commit.timestamp workflow_run.head_repository.full_name
  workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login workflow_run.head_repository.owner.type
  | rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email
  as user_email, workflow_run.head_repository.full_name as repository, workflow_run.head_branch
  as branch | search NOT workflow_run.name=*security-testing* | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `github_actions_disable_security_workflow_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
  to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable
  it in props.conf. Replace *security-testing* with the name of your security testing
  workflow in GitHub Actions.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
drilldown_searches:
- name: View the detection results for - "$repository$"
  search: '%original_detection_search% | search  repository = "$repository$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$repository$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$repository$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: Security Workflow is disabled in branch $branch$ for repository $repository$
  risk_objects:
  - field: repository
    type: other
    score: 27
  threat_objects: []
tags:
  analytic_story:
  - Dev Sec Ops
  asset_type: GitHub
  mitre_attack_id:
  - T1195.002
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: network
tests:
- name: True Positive Test
  attack_data:
  - data:
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log
    source: github
    sourcetype: aws:firehose:json