Revert "Back-porting Version Trimming (#3681)"

This reverts commit 71d2c59b5c.
This commit is contained in:
Mika Ayenson
2024-05-22 13:51:46 -05:00
parent 71d2c59b5c
commit 2c3dbfc039
1036 changed files with 11405 additions and 12359 deletions
@@ -2,14 +2,16 @@
creation_date = "2023/09/11"
integration = ["github"]
maturity = "production"
updated_date = "2024/05/21"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/12/14"
[rule]
author = ["Elastic"]
description = """
Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any
new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise
within your organization and provide unlimited access to data and settings.
Detects when a new member is added to a GitHub organization as an owner.
This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity.
Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
"""
from = "now-9m"
index = ["logs-github.audit-*"]
@@ -19,21 +21,18 @@ name = "New GitHub Owner Added"
risk_score = 47
rule_id = "24401eca-ad0b-4ff9-9431-487a8e183af9"
severity = "medium"
tags = [
"Domain: Cloud",
"Use Case: Threat Detection",
"Use Case: UEBA",
"Tactic: Persistence",
"Data Source: Github",
]
tags = ["Domain: Cloud",
"Use Case: Threat Detection",
"Use Case: UEBA",
"Tactic: Persistence",
"Data Source: Github"
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
iam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
@@ -46,7 +45,6 @@ name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1136/003/"
[rule.threat.tactic]
id = "TA0003"
name = "Persistence"