github-new-rules

[saakovv]

Summary of the Pull Request

• Detects when GitHub Pages of a repository are made public, which may indicate potential unauthorized exposure of sensitive information or code.

• Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

Changelog

Example Log Event

1

{ [-]
action: archived
enterprise: { [-]
avatar_url: https://avatars.githubusercontent.com/
created_at: 2023-06-22
description: null
html_url: https://github.com/enterprises/XXX
id: 50XXX
name: XXX
node_id: E_XXX
slug: XXX
updated_at: 2023-07-27
website_url: XXX
}
organization: { [+]
}
repository: { [+]
}
sender: { [+]
}
}

2

{ [-]
action: unarchived
enterprise: { [-]
avatar_url: https://avatars.githubusercontent.com/
created_at: 2023-06-22
description: null
html_url: https://github.com/enterprises/XXX
id: 50XXX
name: XXX
node_id: E_XXX
slug: XXX
updated_at: 2023-07-27
website_url: null
}
organization: { [+]
}
repository: { [+]
}
sender: { [+]
}
}

3
{
@timestamp: 17212432969
_document_id: n9gWerm
action: repo.pages_public
actor: XXX
actor_id: XXX
actor_is_bot: false
business: XXX
business_id: XXX
created_at: 17212432969
external_identity_nameid: XXX
external_identity_username: null
operation_type: modify
org: XXX
org_id: XXX
public_repo: true
repo: XXX
repo_id: 830148486
user_agent: Mozilla/5.0 (Windows NT 10.0 Win64 x64) AppleWebKit/537.36 (KHTML, like Gecko)
visibility: public
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[saakovv]

fixed
status: experimental

[saakovv]

Hi!
@nasbench , any updates on this review? do you need anything else from me?

[nasbench]

In progress :)

[saakovv]

@nasbench
I have added a link to such a reference, it may be useful.

https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms