Branch was auto-updated.

detections/cloud/github_commit_changes_in_master.yml

@@ -0,0 +1,50 @@
+name: Github Commit Changes In Master
+id: c9d2bfe2-019f-11ec-a8eb-acde48001122
+version: 1
+date: '2021-08-20'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: This search is to detect a pushed or commit to master or main branch. 
+  This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
+  PR for review. of course in some cases admin of the project may did a changes directly to master branch
+search: '`github` branches{}.name = main OR branches{}.name = master
+  |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `github_commit_changes_in_master_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to github logs having the fork, commit, push metadata that can be use
+  to monitor the changes in a github project.
+known_false_positives: admin can do changes directly to master branch
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+tags:
+  analytic_story:
+  - DevSecOps
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1199
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: suspicious commit by $commit.commit.author.email$ to main branch
+  observable:
+  - name: commit.commit.author.email
+    type: User
+    role:
+    - attacker
+  automated_detection_testing: passed

macros/github.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=aws:firehose:json
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: github

tests/cloud/github_commit_changes_in_master.test.yml

@@ -0,0 +1,12 @@
+name: Github Commit Changes In Master Unit Test
+tests:
+- name: Github Commit Changes In Master
+  file: cloud/github_commit_changes_in_master.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-30d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: github_push_master.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log
+    source: github
+    sourcetype: aws:firehose:json