New rules added.

2023-01-28 01:01:30 +05:00
parent 2ba6c3c3f5
commit 1fa926ee31
2 changed files with 87 additions and 0 deletions
@@ -0,0 +1,48 @@
+title: Github Self Hosted Runner Changes Detected
+id: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd
+status: experimental
+description: |
+    A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
+    This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
+    it should be validated from GitHub UI becasue the log entry may not provide full context.
+author: Muhammad Faisal
+date: 2023/01/27
+references:
+    - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation
+tags:
+    - attack.t1526
+    - attack.impact
+    - attack.t1213.003
+    - attack.t1078.004
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'org.remove_self_hosted_runner'
+            - 'org.runner_group_created'
+            - 'org.runner_group_removed'
+            - 'org.runner_group_updated'
+            - 'org.runner_group_runners_added'
+            - 'org.runner_group_runner_removed'
+            - 'org.runner_group_runners_updated'
+            - 'repo.register_self_hosted_runner'
+            - 'repo.remove_self_hosted_runner'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+    - 'transport_protocol_name'
+    - 'repository'
+    - 'repo'
+    - 'repository_public'
+    - '@timestamp'
+falsepositives:
+    - Allowed self-hosted runners changes in the envrionment.
+    - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days.
+    - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day.
+level: low