Nasreddine Bencherchali
598d29f811
chore: change tags, date, modified fields to comply with v2 of the Sigma spec. chore: update the related type from `obsoletes` to `obsolete`. chore: update local json schema to the latest version.
24 lines
1.1 KiB
YAML
24 lines
1.1 KiB
YAML
title: Github Push Protection Bypass Detected
|
|
id: 02cf536a-cf21-4876-8842-4159c8aee3cc
|
|
status: experimental
|
|
description: Detects when a user bypasses the push protection on a secret detected by secret scanning.
|
|
references:
|
|
- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
|
|
- https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
|
|
author: Muhammad Faisal (@faisalusuf)
|
|
date: 2024-03-07
|
|
tags:
|
|
- attack.defense-evasion
|
|
- attack.t1562.001
|
|
logsource:
|
|
product: github
|
|
service: audit
|
|
definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
|
|
detection:
|
|
selection:
|
|
action|contains: 'secret_scanning_push_protection.bypass'
|
|
condition: selection
|
|
falsepositives:
|
|
- Allowed administrative activities.
|
|
level: low
|