Branch-Ruleset - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/branch-ruleset/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 10:00:00 +0000GitHub Enterprise Branch Ruleset Deletionhttps://feed.craftedsignal.io/briefs/2024-01-github-branch-ruleset-deletion/Tue, 09 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-github-branch-ruleset-deletion/Detection of GitHub Enterprise branch ruleset deletion events in audit logs, potentially indicating attempts to bypass security controls and compromise code integrity.This brief focuses on detecting the deletion of branch rulesets within GitHub Enterprise environments. The deletion of these rulesets is a critical security concern as it can lead to the bypass of essential code review processes, facilitate the introduction of unauthorized code changes, and ultimately compromise the integrity of the software supply chain. This activity is identified through analysis of GitHub Enterprise audit logs, specifically targeting events related to the destruction of repository rulesets. The impact of such deletions can be far-reaching, potentially enabling malicious actors to inject vulnerabilities or backdoors into protected branches. This detection is crucial for organizations relying on GitHub Enterprise for code management and collaboration.

Attack Chain

  1. An attacker gains initial access to a GitHub Enterprise account, potentially through compromised credentials or social engineering.
  2. The attacker authenticates to the GitHub Enterprise instance.
  3. The attacker enumerates existing branch rulesets within the target repository to identify those that provide the most significant security controls.
  4. The attacker initiates the deletion of a specific branch ruleset via the GitHub API or web interface.
  5. The repository_ruleset.destroy action is logged in the GitHub Enterprise audit logs.
  6. The attacker makes unauthorized changes to the code within the affected branch, bypassing code review and security checks.
  7. The malicious code is merged into the main branch, potentially leading to the compromise of production systems.
  8. The attacker achieves their objective, such as injecting malicious code or exfiltrating sensitive data.

Impact

The deletion of branch rulesets can have a significant impact on the security posture of an organization. A successful attack could lead to the introduction of vulnerabilities or malicious code into production systems. This can result in data breaches, service disruptions, and reputational damage. The number of affected repositories and the severity of the impact will depend on the extent of the attacker's access and the criticality of the compromised code.

Recommendation

  • Ingest GitHub Enterprise audit logs using Audit log streaming to a SIEM like Splunk using HTTP Event Collector as documented by GitHub [https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk].
  • Deploy the provided Sigma rule to your SIEM to detect the deletion of branch rulesets in GitHub Enterprise.
  • Review and tune the Sigma rule, specifically the github_enterprise_delete_branch_ruleset_filter macro, to reduce false positives in your environment.
  • Investigate any alerts generated by the Sigma rule, focusing on the actor, repository, and timestamp of the event.
  • Consider implementing multi-factor authentication (MFA) for all GitHub Enterprise accounts to reduce the risk of credential compromise.
]]>highadvisorygithubbranch-rulesetdefense-evasionsupply-chain