GitHub IP Allow List Modified

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects changes to a GitHub organization IP allow list: creating, updating, or deleting allow-list entries, or
 11enabling/disabling allow-list enforcement (including enforcement for installed GitHub Apps, the IdP-provided web allow
 12list, and user-level enforcement). Adversaries with org-owner access may add or modify their own address, then enable
 13enforcement, or weaken enforcement and remove legitimate entries to lock out administrators.
 14"""
 15false_positives = [
 16    """
 17    Network changes, office IP rotations, or VPN egress updates performed by org owners. Confirm the entry value and
 18    that enforcement was not enabled unexpectedly.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "GitHub IP Allow List Modified"
 25note = """## Triage and analysis
 26
 27### Investigating GitHub IP Allow List Modified
 28
 29IP allow list entries are often staged before enforcement. An attacker can add a malicious egress IP, then enable the list to persist access and lock out responders.
 30
 31### Possible investigation steps
 32
 33- Identify `user.name`, `github.actor_ip`, and `github.programmatic_access_type`.
 34- In GitHub org authentication security settings, review the entry that was added or removed and whether the allow list is enabled.
 35- Treat `ip_allow_list.enable` as higher urgency than an entry create: enforcement can lock out responders.
 36- Correlate with unusual `git.clone` / `git.push` from new source IPs.
 37
 38### False positive analysis
 39
 40- Adding and removing a test entry during network onboarding.
 41- Automation that syncs allow list entries from a CMDB.
 42
 43### Response and remediation
 44
 45- Remove unauthorized entries and confirm enforcement state matches policy.
 46- Do not enable enforcement until trusted egress IPs are present, to avoid lockout.
 47- Rotate credentials for the actor if the change was not approved.
 48"""
 49references = [
 50    "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization",
 51]
 52risk_score = 47
 53rule_id = "aa11d33a-7c23-4e50-8d2e-f1c72803b61b"
 54severity = "medium"
 55tags = [
 56    "Domain: Cloud",
 57    "Domain: SaaS",
 58    "Platform: GitHub",
 59    "Use Case: Threat Detection",
 60    "Tactic: Defense Evasion",
 61    "Tactic: Persistence",
 62    "Data Source: Github",
 63    "Data Source: GitHub Audit Logs",
 64    "Rule Type: ESQL",
 65    "Resources: Investigation Guide",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-github.audit-* metadata _id, _index, _version
 72| where
 73  event.module == "github" and data_stream.dataset == "github.audit"
 74    and event.action in (
 75      "ip_allow_list_entry.create",
 76      "ip_allow_list_entry.update",
 77      "ip_allow_list_entry.destroy",
 78      "ip_allow_list.enable",
 79      "ip_allow_list.disable",
 80      "ip_allow_list.enable_for_installed_apps",
 81      "ip_allow_list.disable_for_installed_apps",
 82      "ip_allow_list.enable_idp_ip_allowlist_for_web",
 83      "ip_allow_list.disable_idp_ip_allowlist_for_web",
 84      "ip_allow_list.enable_user_level_enforcement",
 85      "ip_allow_list.disable_user_level_enforcement"
 86    )
 87| keep
 88    _id,
 89    _index,
 90    _version,
 91    @timestamp,
 92    event.action,
 93    user.name,
 94    github.org,
 95    github.repo,
 96    github.actor_ip,
 97    github.hashed_token,
 98    github.programmatic_access_type,
 99    github.user_agent,
100    github.name
101'''
102
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106[[rule.threat.technique]]
107id = "T1562"
108name = "Impair Defenses"
109reference = "https://attack.mitre.org/techniques/T1562/"
110[[rule.threat.technique.subtechnique]]
111id = "T1562.007"
112name = "Disable or Modify Cloud Firewall"
113reference = "https://attack.mitre.org/techniques/T1562/007/"
114
115
116
117[rule.threat.tactic]
118id = "TA0005"
119name = "Defense Evasion"
120reference = "https://attack.mitre.org/tactics/TA0005/"
121[[rule.threat]]
122framework = "MITRE ATT&CK"
123[[rule.threat.technique]]
124id = "T1556"
125name = "Modify Authentication Process"
126reference = "https://attack.mitre.org/techniques/T1556/"
127
128
129[rule.threat.tactic]
130id = "TA0003"
131name = "Persistence"
132reference = "https://attack.mitre.org/tactics/TA0003/"
133
134[rule.investigation_fields]
135field_names = [
136    "@timestamp",
137    "event.action",
138    "user.name",
139    "github.org",
140    "github.repo",
141    "github.actor_ip",
142    "github.hashed_token",
143    "github.programmatic_access_type",
144    "github.user_agent",
145    "github.name",
146]