Github High Risk Configuration Disabled
Detects when a user disables a critical security feature for an organization.
Sigma rule (View on GitHub)
1title: Github High Risk Configuration Disabled
2id: 8622c92d-c00e-463c-b09d-fd06166f6794
3status: test
4description: Detects when a user disables a critical security feature for an organization.
5author: Muhammad Faisal (@faisalusuf)
6date: 2023/01/29
7references:
8 - https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
9 - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
10 - https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
11tags:
12 - attack.credential_access
13 - attack.defense_evasion
14 - attack.persistence
15 - attack.t1556
16logsource:
17 product: github
18 service: audit
19 definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
20detection:
21 selection:
22 action:
23 - 'org.advanced_security_policy_selected_member_disabled'
24 - 'org.disable_oauth_app_restrictions'
25 - 'org.disable_two_factor_requirement'
26 - 'repo.advanced_security_disabled'
27 condition: selection
28falsepositives:
29 - Approved administrator/owner activities.
30level: high
References
Related rules
- Change to Authentication Method
- Cisco BGP Authentication Failures
- Cisco LDP Authentication Failures
- Huawei BGP Authentication Failures
- Juniper BGP Missing MD5