GitHub Enterprise IP Allow List Disabled

This analytic identifies when an IP allow list is disabled in GitHub Enterprise. GitHub Enterprise audit logs are monitored for actions related to disabling IP allow lists at the organization or enterprise level. Disabling IP allow lists, a critical security control, restricts access to GitHub Enterprise resources to only trusted IP addresses. When disabled, it could indicate an attacker attempting to bypass access controls to gain unauthorized access from untrusted networks. This activity can be triggered by a malicious insider or compromised admin credentials. Exposure of sensitive code repositories and GitHub Enterprise resources could be exposed to access from any IP address if this control is disabled.

Attack Chain

1. An attacker compromises a GitHub Enterprise administrator account through credential stuffing or phishing (T1195, TA0001).
2. The attacker authenticates to the GitHub Enterprise management console using the compromised credentials.
3. The attacker navigates to the IP allow list configuration settings.
4. The attacker disables the IP allow list, removing the restriction on trusted IP addresses (T1562.001, TA0005).
5. The attacker, now operating from an untrusted IP address, accesses sensitive code repositories.
6. The attacker clones the repositories to their local system.
7. The attacker searches the codebase for sensitive information, such as API keys and credentials.
8. The attacker leverages the stolen credentials to access other systems or services, leading to further compromise.

Impact

Disabling the IP allow list can expose sensitive code repositories and GitHub Enterprise resources to unauthorized access from any IP address. This exposure can lead to the theft of proprietary code, intellectual property, and sensitive credentials. The attacker could then use the stolen credentials to pivot to other systems or services, resulting in a wider breach. A successful attack can result in significant financial losses, reputational damage, and legal liabilities.

Recommendation

• Enable Sysmon process creation logging to monitor for suspicious processes spawned by user accounts used to manage GitHub Enterprise (logsource: process_creation, product: windows).
• Deploy the Sigma rule Detect GitHub IP Allow List Disable to your SIEM and tune for your environment (rules).
• Investigate any alerts generated by the Detect GitHub IP Allow List Disable rule immediately, particularly if the action was not pre-approved (rules).
• Review user activity logs for the user accounts that disabled the IP allow list for any other suspicious activity (references).
• Enforce multi-factor authentication (MFA) for all GitHub Enterprise accounts, especially administrator accounts, to prevent credential compromise (references).