GitHub Actions Unusual Bot Push to Repository

  1[metadata]
  2creation_date = "2025/12/09"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/04/10"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when the github-actions[bot] pushes code to a repository where it has not performed this behavior before in a certain time window. This may
 11indicate a supply chain attack where malicious code running in a CI workflow attempts to modify repository contents,
 12such as injecting backdoor workflow files.
 13"""
 14false_positives = [
 15    """
 16    Legitimate CI/CD automation that commits and pushes changes (e.g., auto-formatting, changelog updates, version
 17    bumps, Dependabot auto-merge) will trigger this alert on first use in a repository. Review the repository's
 18    workflow configurations to determine if bot pushes are expected.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-github.audit-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "GitHub Actions Unusual Bot Push to Repository"
 26note = """## Triage and analysis
 27
 28### Investigating GitHub Actions Unusual Bot Push to Repository
 29
 30This rule detects when the GitHub Actions bot pushes to a repository where it hasn't pushed to in a certain time interval. While this can be
 31legitimate automation, it may also indicate a supply chain attack where malicious code executes during CI and attempts
 32to modify repository contents.
 33
 34### Possible investigation steps
 35
 36- Review the `github.repo` field to identify the affected repository.
 37- Check recent workflow runs in the repository to identify which workflow triggered the push.
 38- Examine the repository's commit history to see what files were modified by the bot push.
 39- Look for newly added or modified files in `.github/workflows/` directory.
 40- Review the repository's dependencies for recently added or updated packages with preinstall/postinstall hooks.
 41- Check if the repository has legitimate automation that would explain bot pushes (Dependabot, Renovate, release automation).
 42- Correlate with `protected_branch.rejected_ref_update` events to see if workflow injection was blocked.
 43- Search for other repositories in the organization with similar suspicious activity.
 44
 45### False positive analysis
 46
 47- Repositories with auto-commit workflows (formatting, changelog generation, version bumps) will trigger on first run.
 48- Dependabot or Renovate auto-merge configurations cause legitimate bot pushes.
 49- GitHub Pages deployment workflows may push to gh-pages branches.
 50- Release automation that updates version files or generates artifacts.
 51
 52### Response and remediation
 53
 54- If the push is unexpected, immediately review the commit contents for malicious files.
 55- Check for suspicious workflow files (e.g., `discussion_*.yaml`, `formatter_*.yml`).
 56- Audit all dependencies in the affected repository for malicious packages.
 57- Rotate any secrets that may have been exposed during the workflow run.
 58- Enable branch protection rules to require PR reviews for all changes.
 59- Consider restricting GITHUB_TOKEN permissions in workflow files using `permissions:` key.
 60"""
 61references = [
 62    "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
 63    "https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
 64]
 65risk_score = 21
 66rule_id = "03245b25-3849-4052-ab48-72de65a82c35"
 67severity = "low"
 68tags = [
 69    "Domain: Cloud",
 70    "Use Case: Threat Detection",
 71    "Tactic: Initial Access",
 72    "Tactic: Persistence",
 73    "Data Source: Github",
 74    "Resources: Investigation Guide",
 75]
 76timestamp_override = "event.ingested"
 77type = "new_terms"
 78
 79query = '''
 80data_stream.dataset: "github.audit" and
 81    event.action: "git.push" and
 82    user.name: "github-actions[bot]"
 83'''
 84
 85[[rule.threat]]
 86framework = "MITRE ATT&CK"
 87
 88[[rule.threat.technique]]
 89id = "T1195"
 90name = "Supply Chain Compromise"
 91reference = "https://attack.mitre.org/techniques/T1195/"
 92
 93[[rule.threat.technique.subtechnique]]
 94id = "T1195.002"
 95name = "Compromise Software Supply Chain"
 96reference = "https://attack.mitre.org/techniques/T1195/002/"
 97
 98[rule.threat.tactic]
 99id = "TA0001"
100name = "Initial Access"
101reference = "https://attack.mitre.org/tactics/TA0001/"
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105
106[[rule.threat.technique]]
107id = "T1059"
108name = "Command and Scripting Interpreter"
109reference = "https://attack.mitre.org/techniques/T1059/"
110
111[rule.threat.tactic]
112id = "TA0002"
113name = "Execution"
114reference = "https://attack.mitre.org/tactics/TA0002/"
115
116[[rule.threat]]
117framework = "MITRE ATT&CK"
118
119[[rule.threat.technique]]
120id = "T1565"
121name = "Data Manipulation"
122reference = "https://attack.mitre.org/techniques/T1565/"
123
124[[rule.threat.technique.subtechnique]]
125id = "T1565.001"
126name = "Stored Data Manipulation"
127reference = "https://attack.mitre.org/techniques/T1565/001/"
128
129[rule.threat.tactic]
130id = "TA0040"
131name = "Impact"
132reference = "https://attack.mitre.org/tactics/TA0040/"
133[rule.new_terms]
134field = "new_terms_fields"
135value = ["github.org_id", "github.repo"]
136
137[[rule.new_terms.history_window_start]]
138field = "history_window_start"
139value = "now-7d"