security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Back-porting Version Trimming (#3681)"

Browse Source 
This reverts commit 71d2c59b5c.
This commit is contained in:
Mika Ayenson
2024-05-22 13:51:46 -05:00
parent 71d2c59b5c
commit 2c3dbfc039
1036 changed files with 11405 additions and 12359 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/github/execution_new_github_app_installed.toml
+9 -8
View File
@@ -2,16 +2,18 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
updated_date = "2024/05/21"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/03"
[rule]
author = ["Elastic"]
description = """
This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's
functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify
your repository and organization data. Only trusted apps should be installed and any newly installed apps should be
investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture
and leave you exposed for future attacks.
This rule detects when a new GitHub App has been installed in your organization account.
GitHub Apps extend GitHub's functionality both within and outside of GitHub.
When an app is installed it is granted permissions to read or modify your repository and organization data.
Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy.
Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.
"""
from = "now-9m"
index = ["logs-github.audit-*"]
@@ -24,12 +26,10 @@ severity = "medium"
tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
configuration where event.dataset == "github.audit" and event.action == "integration_installation.create"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
@@ -38,6 +38,7 @@ name = "Software Deployment Tools"
reference = "https://attack.mitre.org/techniques/T1072/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"