December 6, 2024 - Content Release

This content release:

• Introduces new Cloud SIEM detection rules for monitoring activity and alerts from GitHub Enterprise.
• New and updated log parsing and mapping support for:
  • AWS VPC Transit Gateways Flow Logs
  • Alert Logic
  • Google G Suite Alert Center
  • Microsoft Defender Advanced Hunting
  • Azure Provisioning, Alert, ResourceHealth, and ServiceHealth events

Changes are enumerated below.

note

First Seen Successful Authentication From Unexpected Country (FIRST-S00029), which is disabled by default, has been replaced by a rule of the same name (FIRST-S00065) which is enabled by default. FIRST-S00029 will be removed in a subsequent release in 2 weeks (week of December 16). Any tuning expressions applied to FIRST-S00029 will need to be migrated to FIRST-S00065 to continue functioning.

Rules

• [New] MATCH-S00952 GitHub - Administrator Added or Invited
  • Detects additions or invitations of GitHub Administrators. Illegitimate addition of administrative users could be an indication of privilege escalation or persistence by adversaries.
• [New] MATCH-S00953 GitHub - Audit Logging Modification
  • Detects modifications to the GitHub Enterprise Audit Log. Modifications and deletions have the potential to reduce visibility of malicious activity.
• [New] MATCH-S00954 GitHub - Copilot Seat Cancelled by GitHub
  • Observes for GitHub staff manually revoking copilot access for a user. This action is likely to be rare and may be indicative of a user violating the acceptable use policy for GitHub.
• [New] FIRST-S00091 GitHub - First Seen Activity From Country for User
  • Detects GitHub user activity from a new country. User account compromises can be detected through unusual geolocation in some cases. To lower possible false positives, a tuning expression for expected country names or codes can be added,.
• [New] FIRST-S00090 GitHub - First Seen Application Interacting with API
  • Detects new application usage of the GitHub API. New applications utilizing the API may be routine, however this may also reveal malicious applications utilizing the API.
• [New] MATCH-S00950 GitHub - Member Invitation or Addition
  • Detects new user additions or invitations to the business or organization GitHub. New user additions/invitations should be monitored as they could be a vector for malicious actors to establish access or persistence.
• [New] MATCH-S00955 GitHub - Member Permissions Modification
  • Detects modifications of GitHub user permissions. Added permissions for a user should be monitored for potential privilege escalation by an adversary.
• [New] MATCH-S00956 GitHub - OAuth Application Activity
  • Detects OAuth application activities within GitHub. OAuth application management and access activity should be monitored for potential abuse by potential malicious actors, either by creating malicious access paths within GitHub, or destruction of GitHub infrastructure.
• [New] MATCH-S00957 GitHub - Organization Transfer
  • Detects transfers of an organization to another enterprise This is a sensitive activity that should be monitored to ensure organizations and their repositories are not being transferred without proper authorization.
• [New] OUTLIER-S00026 GitHub - Outlier in Distinct User Agent Strings by User
  • Detects an outlier in the number of distinct user agent strings for a GitHub user. Unusual user agent strings for a user account could indicate account takeover.
• [New] OUTLIER-S00028 GitHub - Outlier in Removal Actions by User
  • Detects a higher than usual number of removal actions undertaken by a user. This detection has a broad scope to detect any unusual number of destroy, delete, or remove actions undertaken by a user to help detect a range of different potential destructive activities in GitHub.
• [New] OUTLIER-S00027 GitHub - Outlier in Repository Cloning or Downloads
  • Detects an unusual number of repository clones for a user. Unusual repository cloning could indicate data exfiltration or discovery.
• [New] MATCH-S00958 GitHub - PR Review Requirement Removed
  • Detects GitHub pull request review requirements being removed from a repository either via branch protection rule or ruleset.
• [New] MATCH-S00959 GitHub - Repository Public Key Deletion
  • Detects deletions of SSH keys in GitHub. Unusual deletions could represent an adversary attempting to disrupt normal operations by denying access.
• [New] MATCH-S00960 GitHub - Repository Transfer
  • Detects transfers of a repository to another organization or user. This is a sensitive activity that GitHub places in the "Danger Zone" of repository setting and should be monitored to ensure no unauthorized transfers are taking place.
• [New] MATCH-S00961 GitHub - Repository Visibility Changed to Public
  • Detects a user making a repository public. This action should be closely monitored and mitigative actions taken even if the published repository is deleted, or reverted to private. Reference: https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github
• [New] MATCH-S00962 GitHub - Repository Visibility Permissions Changed
  • Detects repository visibility permissions being changed to allow members of an organization to change the visibility of repositories. This activity introduces the potential for data leakage if a private or internal repository is changed to public and should be monitored to ensure no inadvertent or malicious publication of a repository.
• [New] MATCH-S00963 GitHub - SSH Key Created for Private Repo
  • Detects the creation of an SSH key for a private GitHub repository. Performed maliciously, creating an SSH key could create a parallel access path for an attacker.
• [New] MATCH-S00964 GitHub - SSO Recovery Codes Access Activity
  • Detects activities accessing SSO recovery codes. SSO recovery codes can enable a user to bypass normal more stringent authentication routes.
• [New] MATCH-S00951 GitHub - Secret Scanning Alert
  • Observes for secret scanning alerts from GitHub. Secrets detected by GitHub Enterprise Cloud undergo validation by GitHub automatically, to determine whether they are actively in use, this is not surfaced in the audit log, and will require separate inspection. For more information see Evaluating alerts from secret scanning.
• [New] MATCH-S00965 GitHub - Secret Scanning Potentially Disabled
  • Detects actions which disable or modify secret scanning policies for an organization or repository. Modifying or disabling secret scanning may lead to inadvertent leaking of credentials.
• [New] MATCH-S00966 GitHub - Two-Factor Authentication Disabled for Organization
  • Observes for two-factor authentication being disabled for a GitHub organization. Removing two-factor authentication requirements significantly degrades the security of the GitHub organization by permitting password only authentication.
• [Updated] THRESHOLD-S00095 Password Attack from Host
  • Modified the rule expression to remove the srcDevice_ip entity selector and the isNull from the rule expression for entities from the existing rule, and creates a new rule for those entities so that there are 2 versions of the rule's intent.

Log Mappers

• [New] AWS VPC Transit Gateways Flow Logs
• [New] Alert Logic Catch All
• [New] Azure ResourceHealth and ServiceHealth
• [New] Google G Suite Alert Center - User Changes
• [New] Microsoft Defender Advanced Hunting - Alert
• [New] Microsoft Defender Advanced Hunting - Audit
• [New] Microsoft Defender Advanced Hunting - Email events
• [New] Microsoft Defender Advanced Hunting - Logon
• [New] Microsoft Defender Advanced Hunting - Network
• [Updated] Azure Event Hub - Windows Defender Logs and Azure Alert
  • Adds support for additional event types and field mappings.
• [Updated] Trend Micro Vision One Custom Parser
  • Supports additional field names.

Parsers

• [New] /Parsers/System/AWS/AWS VPC Transit Gateways Flow Logs
• [New] /Parsers/System/Alert Logic/Alert Logic
• [New] /Parsers/System/Microsoft/Microsoft Defender Advanced Hunting
• [Updated] /Parsers/System/Trend Micro/Trend Micro Vision One
  • Parser updated to support additional event format.