Attack Chain

1. The attacker gains initial access to a GitHub account with sufficient privileges to modify branch protection rules.
2. The attacker authenticates to the GitHub organization and navigates to the repository settings.
3. The attacker identifies a target branch with classic branch protection rules enabled.
4. The attacker disables the classic branch protection rules for the target branch, generating a protected_branch.destroy event in the audit logs.
5. The attacker commits and pushes unauthorized code changes, bypassing code review and other protection mechanisms.
6. The malicious code is merged into the protected branch, potentially introducing vulnerabilities or backdoors into the codebase.
7. The attacker may attempt to further obfuscate their actions by deleting audit logs or modifying other security settings (not covered in this specific detection).

Impact

The disabling of classic branch protection rules can have severe consequences, leading to potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and ultimately, a compromise of software supply chain integrity. The impact includes the potential for unauthorized code changes being introduced into production environments, leading to data breaches, service disruptions, or other security incidents. The number of victims depends on the scope of the affected repository and the criticality of the compromised code.

Recommendation

• Deploy the following Sigma rule to your SIEM to detect instances of disabled classic branch protection rules and tune for your environment.
• Investigate any detected instances of disabled branch protection rules, focusing on the actor, repository, and timeline of events.
• Implement multi-factor authentication (MFA) for all GitHub accounts, especially those with administrative privileges, to reduce the risk of unauthorized access.
• Regularly review and audit GitHub organization settings, including branch protection rules, to ensure they are properly configured and enforced.
• Utilize the Splunk Add-on for Github to ingest GitHub Organizations audit logs as specified in the "how_to_implement" section to ensure proper data ingestion for the detection rule.