security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Back-porting Version Trimming (#3704)

Browse Source
This commit is contained in:
shashank-elastic
2024-05-23 00:45:10 +05:30
committed by GitHub
parent 2c3dbfc039
commit 63e91c2f12
1016 changed files with 12005 additions and 11259 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/github/execution_new_github_app_installed.toml
+8 -9
View File
@@ -2,18 +2,16 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/03"
updated_date = "2024/05/21"
[rule]
author = ["Elastic"]
description = """
This rule detects when a new GitHub App has been installed in your organization account.
GitHub Apps extend GitHub's functionality both within and outside of GitHub.
When an app is installed it is granted permissions to read or modify your repository and organization data.
Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy.
Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.
This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's
functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify
your repository and organization data. Only trusted apps should be installed and any newly installed apps should be
investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture
and leave you exposed for future attacks.
"""
from = "now-9m"
index = ["logs-github.audit-*"]
@@ -26,10 +24,12 @@ severity = "medium"
tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
configuration where event.dataset == "github.audit" and event.action == "integration_installation.create"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
@@ -38,7 +38,6 @@ name = "Software Deployment Tools"
reference = "https://attack.mitre.org/techniques/T1072/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"