App-Installation - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/app-installation/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 02 Jan 2024 12:00:00 +0000New GitHub App Installation Detectionhttps://feed.craftedsignal.io/briefs/2024-01-github-app-installed/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-github-app-installed/The installation of a new GitHub application within an organization's account may indicate malicious activity by granting unauthorized access to repositories and organizational data.This alert detects when a new GitHub App is installed within an organization. GitHub Apps enhance functionality, but malicious actors can abuse them to gain unauthorized access to repositories and organizational data. Attackers can leverage these apps post-compromise to maintain persistence and execute commands. The rule focuses on identifying suspicious GitHub App installations, particularly those with excessive permissions or from untrusted developers. Defenders need to prioritize investigating newly installed apps to ensure their legitimacy and prevent potential data breaches or malicious activities within the GitHub environment. This includes verifying the app's permissions, developer identity, and intended purpose. The detection rule focuses on logs generated after August 29, 2023, when the rule was initially created.

Attack Chain

  1. The attacker gains initial access, possibly through compromised credentials or social engineering (T1199).
  2. The attacker logs into a GitHub account with sufficient privileges to install applications.
  3. The attacker creates or identifies a malicious GitHub App, potentially mimicking a legitimate service.
  4. The attacker installs the malicious GitHub App within the target organization, granting it specific permissions.
  5. The GitHub App is installed, triggering a log event integration_installation.create in the GitHub audit logs.
  6. The application leverages granted permissions to read or modify repository data.
  7. The attacker uses the GitHub App to execute commands or deploy malicious software within the connected repositories or systems (T1072).
  8. The attacker maintains persistence through the installed application, enabling continued access and control over the environment (T1098).

Impact

Successful exploitation can lead to unauthorized access to sensitive code repositories, intellectual property theft, and potential supply chain attacks. A compromised GitHub App can be used to inject malicious code into software projects, affecting numerous downstream users. Organizations relying on GitHub for code management and collaboration are particularly vulnerable. A successful attack could result in reputational damage, financial losses, and legal liabilities.

Recommendation

  • Deploy the GitHub App Installation Detected Sigma rule to your SIEM and tune it for your environment to detect suspicious GitHub App installations.
  • Enable GitHub audit logging and ensure the logs are being ingested into your SIEM (Data Source: Github).
  • Investigate any alerts generated by the Sigma rule by reviewing the GitHub audit logs for the event.dataset "github.audit" and event.action "integration_installation.create" to identify the newly installed GitHub App.
  • Implement stricter access controls and approval processes for future GitHub App installations to prevent unauthorized installations.
]]>mediumadvisorygithubapp-installationexecution