Merge pull request #3942 from faisalusuf/master

rules/cloud/github/github_delete_action_invoked.yml

@@ -0,0 +1,30 @@
+title: Github Delete Action Invoked
+id: 16a71777-0b2e-4db7-9888-9d59cb75200b
+status: experimental
+description: Detects delete action in the Github audit logs for codespaces, environment, project and repo.
+author: Muhammad Faisal
+date: 2023/01/19
+references:
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
+tags:
+    - attack.impact
+    - attack.t1213.003
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'codespaces.delete'
+            - 'environment.delete'
+            - 'project.delete'
+            - 'repo.destroy'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+falsepositives:
+     - Validate the deletion activity is permitted. The "actor" field need to be validated.
+level: medium

rules/cloud/github/github_new_secret_created.yml

@@ -0,0 +1,30 @@
+title: Github New Secret Created
+id: f9405037-bc97-4eb7-baba-167dad399b83
+status: experimental
+description: Detects when a user creates action secret for the organization, environment, codespaces or repository.
+author: Muhammad Faisal
+date: 2023/01/20
+references:
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
+tags:
+    - attack.t1078
+    - attack.t1078.004
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'org.create_actions_secret'
+            - 'environment.create_actions_secret'
+            - 'codespaces.create_an_org_secret'
+            - 'repo.create_actions_secret'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+falsepositives:
+     - This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the "actor".
+level: low

rules/cloud/github/github_outside_collaborator_detected.yml

@@ -0,0 +1,31 @@
+title: Github Outside Collaborator Detected
+id: eaa9ac35-1730-441f-9587-25767bde99d7
+status: experimental
+description: Detects  when an organization member or outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
+author: Muhammad Faisal
+date: 2023/01/20
+references:
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
+tags:
+    - attack.t1098.001
+    - attack.t1213.003
+    - attack.t1098.003
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'project.update_user_permission'
+            - 'org.remove_outside_collaborator'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+falsepositives:
+    - Validate the actor if permitted to access the repo.
+    - Validate the Multifactor Authentication changes.
+level: medium

tests/logsource.json

@@ -264,6 +264,14 @@
                 "gcp.audit":[]
             }
         },
+        "github":{
+            "commun": [],
+            "empty": [],
+            "category":{},
+            "service":{
+                "audit":[]
+            }
+        },
         "google_workspace":{
             "commun": [],
             "empty": [],