security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Back-porting Version Trimming (#3681)

Browse Source
This commit is contained in:
shashank-elastic
2024-05-23 00:11:50 +05:30
committed by GitHub
parent 58ba0713fe
commit 71d2c59b5c
1036 changed files with 12346 additions and 11392 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/github/execution_new_github_app_installed.toml
+8 -9
View File
@@ -2,18 +2,16 @@
creation_date = "2023/08/29"
integration = ["github"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/10/03"
updated_date = "2024/05/21"
[rule]
author = ["Elastic"]
description = """
This rule detects when a new GitHub App has been installed in your organization account.
GitHub Apps extend GitHub's functionality both within and outside of GitHub.
When an app is installed it is granted permissions to read or modify your repository and organization data.
Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy.
Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.
This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's
functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify
your repository and organization data. Only trusted apps should be installed and any newly installed apps should be
investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture
and leave you exposed for future attacks.
"""
from = "now-9m"
index = ["logs-github.audit-*"]
@@ -26,10 +24,12 @@ severity = "medium"
tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github"]
timestamp_override = "event.ingested"
type = "eql"
query = '''
configuration where event.dataset == "github.audit" and event.action == "integration_installation.create"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
@@ -38,7 +38,6 @@ name = "Software Deployment Tools"
reference = "https://attack.mitre.org/techniques/T1072/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"