GitHub Organizations - CraftedSignal Threat Feed

GitHub Organizations Branch Ruleset Deletion

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief focuses on the detection of deleted branch rulesets within GitHub Organizations. Threat actors may attempt to disable or delete these rulesets to bypass code review requirements and security controls. This activity can be an indicator of malicious intent, potentially leading to the injection of unauthorized code changes or backdoors into protected branches. The detection mechanism involves monitoring GitHub Organizations audit logs for specific events related to branch ruleset deletion. Identifying these events allows for timely intervention to prevent code tampering and maintain software supply chain integrity. This is crucial for organizations relying on GitHub for code management and collaboration.

Attack Chain

Initial Access: An attacker gains access to a GitHub account with sufficient privileges to manage branch rulesets.
Reconnaissance: The attacker identifies target repositories and their associated branch rulesets.
Privilege Escalation (if necessary): The attacker elevates their privileges within the organization to gain the ability to modify or delete rulesets.
Defense Evasion: The attacker deletes a branch ruleset, effectively disabling the security controls it provided (e.g., code review, preventing force pushes).
Code Injection: The attacker pushes unauthorized code changes, potentially containing malicious code or backdoors, directly to a protected branch.
Persistence (Optional): The attacker may implement persistence mechanisms within the injected code to maintain unauthorized access.
Impact: The malicious code compromises the software supply chain, potentially affecting downstream users and systems.

Impact

The deletion of branch rulesets can have significant consequences, leading to code tampering, bypass of security reviews, and the introduction of vulnerabilities or malicious code. If successful, this can compromise the integrity of the software supply chain, impacting potentially thousands of users and systems relying on the affected code. The incident could result in data breaches, financial losses, and reputational damage.

Recommendation

Enable GitHub Organizations audit logs and ingest them into your SIEM to allow for monitoring of branch ruleset deletion events.
Deploy the Sigma rule GitHub Organizations Delete Branch Ruleset to detect when branch rulesets are deleted in GitHub Organizations.
Investigate any alerts triggered by the Sigma rule, focusing on the actor, repo, and ruleset_name to determine the legitimacy of the action.
Implement multi-factor authentication (MFA) for all GitHub accounts to reduce the risk of unauthorized access (Reference: GitHub documentation).
Regularly review and audit GitHub Organizations permissions to ensure that users only have the necessary privileges (Reference: GitHub documentation).

GitHub Organizations 2FA Requirement Disabled

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief focuses on the detection of disabled two-factor authentication (2FA) requirements within GitHub Organizations. The activity is detected by monitoring GitHub Organizations audit logs for the org.disable_two_factor_requirement event. Identifying disabled 2FA is critical because it undermines a fundamental security control and can expose organizations to increased risk of account takeover. The absence of 2FA makes accounts more vulnerable to password-based attacks, potentially granting attackers access to sensitive code, intellectual property, and the ability to compromise the software supply chain. This event can be an early warning sign of a more extensive attack campaign.

Attack Chain

The attacker gains initial access to an account with sufficient privileges to modify organization settings (T1195).
The attacker authenticates to the GitHub platform, bypassing existing 2FA if the account is already enrolled.
The attacker navigates to the organization settings within GitHub.
The attacker disables the 2FA requirement for the GitHub organization. This action is logged as org.disable_two_factor_requirement in the audit logs.
With 2FA disabled, the attacker targets other organization member accounts with password-based attacks such as credential stuffing or brute-force attacks.
Successful account compromise allows the attacker to access private repositories and sensitive information.
The attacker may inject malicious code into repositories to compromise the software supply chain.
The attacker may exfiltrate sensitive data or intellectual property (T1562.001).

Impact

The impact of disabled 2FA in GitHub Organizations can be significant, leading to account compromise, unauthorized access to sensitive code repositories, intellectual property theft, and potential compromise of the software supply chain. A successful attack could result in financial losses, reputational damage, and legal liabilities. The number of affected accounts and the severity of the impact depend on the attacker's objectives and the organization's security posture.

Recommendation

Deploy the Sigma rule GitHub Organizations Disable 2FA Requirement to your SIEM to detect instances of 2FA being disabled (see rules).
Investigate any detected instances of disabled 2FA to determine the legitimacy of the action and identify any potential compromise.
Review GitHub organization audit logs for related suspicious activities, such as unusual login attempts or changes to other security settings.
Enforce 2FA for all members of GitHub Organizations and regularly audit 2FA enforcement policies.
Monitor the github_organizations data source for other vendor actions to identify suspicious activity within the GitHub environment.

GitHub Organization Repository Deletion

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This threat brief focuses on the anomalous deletion of repositories within GitHub organizations, an activity that can have severe consequences. The core concern is that a malicious actor, whether an external attacker with compromised credentials or a malicious insider, may deliberately delete repositories to destroy source code, intellectual property, or even evidence of a prior compromise. The behavior is detected by monitoring GitHub Organizations audit logs for repository deletion events (vendor_action=repo.destroy). The deletion of repositories may lead to permanent data loss if backups are not maintained. This activity may be associated with attempts to disrupt business operations. Early detection of such events is crucial, allowing security teams to investigate potential compromises and initiate recovery procedures, minimizing potential damage.

Attack Chain

Initial Access: The attacker gains unauthorized access to a GitHub organization account. This could be through compromised credentials (phishing, password reuse), or by exploiting a vulnerability in a service integrated with GitHub.
Privilege Escalation (if needed): The attacker elevates their privileges within the GitHub organization to gain sufficient permissions to delete repositories.
Reconnaissance: The attacker identifies valuable or critical repositories for deletion, potentially focusing on those containing sensitive data, core application code, or incident response documentation.
Disable Security Controls (Optional): The attacker attempts to disable or circumvent security controls within GitHub or integrated security tools to avoid detection.
Repository Deletion: The attacker executes the repository deletion command, either through the GitHub web interface or the GitHub API. This generates an audit log event (vendor_action=repo.destroy).
Obfuscation/Cleanup: The attacker attempts to cover their tracks by deleting audit logs, modifying access logs, or removing any traces of their activity within the GitHub environment.
Impact: The targeted repository is permanently deleted, resulting in the loss of source code, documentation, and project history. This can disrupt development workflows, lead to financial losses, and compromise intellectual property.

Impact

The impact of a successful repository deletion attack can be significant. Organizations can experience a loss of intellectual property, disruption to development workflows, and potential financial losses resulting from the lost work and the cost of recovery. In severe cases, the deletion of critical repositories could halt operations and damage the organization's reputation. The number of affected repositories and the severity of the impact depend on the attacker's objectives and the organization's backup and recovery capabilities.

Recommendation

Deploy the provided Sigma rules to your SIEM and tune them to your specific GitHub organization to detect anomalous repository deletion activity based on vendor_action=repo.destroy.
Implement multi-factor authentication (MFA) for all GitHub accounts, especially those with administrative privileges, to mitigate the risk of compromised credentials referenced in the attack chain.
Regularly review and audit GitHub organization access controls and permissions to identify and remediate any excessive or unnecessary privileges, preventing privilege escalation.
Implement a robust backup and recovery strategy for GitHub repositories, including regular backups and tested restoration procedures, ensuring quick recovery in case of a repository deletion attack.
Monitor GitHub Organizations audit logs for suspicious activity, including unusual login patterns, unauthorized permission changes, and unexpected API calls.