New GitHub Owner Added
Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2023/09/11"
3integration = ["github"]
4maturity = "production"
5updated_date = "2024/11/27"
6min_stack_version = "8.12.0"
7min_stack_comments = "Breaking change at 8.12.0 for the Github Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any
13new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise
14within your organization and provide unlimited access to data and settings.
15"""
16from = "now-9m"
17index = ["logs-github.audit-*"]
18language = "eql"
19license = "Elastic License v2"
20name = "New GitHub Owner Added"
21risk_score = 47
22rule_id = "24401eca-ad0b-4ff9-9431-487a8e183af9"
23severity = "medium"
24tags = [
25 "Domain: Cloud",
26 "Use Case: Threat Detection",
27 "Use Case: UEBA",
28 "Tactic: Persistence",
29 "Data Source: Github",
30]
31timestamp_override = "event.ingested"
32type = "eql"
33
34query = '''
35iam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin"
36'''
37
38
39[[rule.threat]]
40framework = "MITRE ATT&CK"
41[[rule.threat.technique]]
42id = "T1136"
43name = "Create Account"
44reference = "https://attack.mitre.org/techniques/T1136/"
45[[rule.threat.technique.subtechnique]]
46id = "T1136.003"
47name = "Cloud Account"
48reference = "https://attack.mitre.org/techniques/T1136/003/"
49
50
51
52[rule.threat.tactic]
53id = "TA0003"
54name = "Persistence"
55reference = "https://attack.mitre.org/tactics/TA0003/"
Related rules
- GitHub Owner Role Granted To User
- High Number of Cloned GitHub Repos From PAT
- GitHub UEBA - Multiple Alerts from a GitHub Account
- GitHub App Deleted
- GitHub Protected Branch Settings Changed