Github Secret Scanning Feature Disabled
Detects if the secret scanning feature is disabled for an enterprise or repository.
Sigma rule (View on GitHub)
1title: Github Secret Scanning Feature Disabled
2id: 3883d9a0-fd0f-440f-afbb-445a2a799bb8
3status: experimental
4description: Detects if the secret scanning feature is disabled for an enterprise or repository.
5references:
6 - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
7author: Muhammad Faisal (@faisalusuf)
8date: 2024/03/07
9tags:
10 - attack.defense_evasion
11 - attack.t1562.001
12logsource:
13 product: github
14 service: audit
15 definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
16detection:
17 selection:
18 action:
19 - 'business_secret_scanning.disable'
20 - 'business_secret_scanning.disabled_for_new_repos'
21 - 'repository_secret_scanning.disable'
22 - 'secret_scanning.disable'
23 condition: selection
24falsepositives:
25 - Allowed administrative activities.
26level: high
References
Related rules
- Github Push Protection Bypass Detected
- Github Push Protection Disabled
- HackTool - Stracciatella Execution
- Microsoft Malware Protection Engine Crash
- Microsoft Malware Protection Engine Crash - WER