diff --git a/detections/cloud/github_enterprise_created_self_hosted_runner.yml b/detections/cloud/github_enterprise_created_self_hosted_runner.yml index 963f853d77..bf4aefc735 100644 --- a/detections/cloud/github_enterprise_created_self_hosted_runner.yml +++ b/detections/cloud/github_enterprise_created_self_hosted_runner.yml @@ -34,33 +34,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ created a self-hosted runner in GitHub Enterprise + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ created a self-hosted runner in GitHub Enterprise mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_delete_branch_ruleset.yml b/detections/cloud/github_enterprise_delete_branch_ruleset.yml index f0d5d00652..dd186cc579 100644 --- a/detections/cloud/github_enterprise_delete_branch_ruleset.yml +++ b/detections/cloud/github_enterprise_delete_branch_ruleset.yml @@ -35,38 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ deleted a branch ruleset in repo $repo$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ deleted a branch ruleset in repo $repo$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user_agent - - ruleset_name - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_disable_2fa_requirement.yml b/detections/cloud/github_enterprise_disable_2fa_requirement.yml index 1030a44b79..2295bf2dbb 100644 --- a/detections/cloud/github_enterprise_disable_2fa_requirement.yml +++ b/detections/cloud/github_enterprise_disable_2fa_requirement.yml @@ -35,33 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ disabled 2FA requirement + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ disabled 2FA requirement mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml b/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml index 51d8439c61..4489e8c45d 100644 --- a/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml +++ b/detections/cloud/github_enterprise_disable_audit_log_event_stream.yml @@ -35,34 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Audit log event streaming is disabled by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: Audit log event streaming is disabled by $user$ mitre_attack_id: - T1562.008 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml b/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml index 842e563852..c048624fa1 100644 --- a/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml +++ b/detections/cloud/github_enterprise_disable_classic_branch_protection_rule.yml @@ -35,38 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ disabled a classic branch protection rule in repo $repo$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ disabled a classic branch protection rule in repo $repo$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user_agent - - name - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_disable_dependabot.yml b/detections/cloud/github_enterprise_disable_dependabot.yml index b91556d7d7..5b2196a7a0 100644 --- a/detections/cloud/github_enterprise_disable_dependabot.yml +++ b/detections/cloud/github_enterprise_disable_dependabot.yml @@ -33,40 +33,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Dependabot security features are disabled in repository $repo$ by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: Dependabot security features are disabled in repository $repo$ by $user$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_disable_ip_allow_list.yml b/detections/cloud/github_enterprise_disable_ip_allow_list.yml index e1b9805edb..dc60ccfd63 100644 --- a/detections/cloud/github_enterprise_disable_ip_allow_list.yml +++ b/detections/cloud/github_enterprise_disable_ip_allow_list.yml @@ -34,33 +34,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ disabled an IP allow list in GitHub Enterprise + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ disabled an IP allow list in GitHub Enterprise mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml b/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml index 0c33fe5476..f1f55421fa 100644 --- a/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml +++ b/detections/cloud/github_enterprise_modify_audit_log_event_stream.yml @@ -35,34 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Audit log event streaming is modified by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: Audit log event streaming is modified by $user$ mitre_attack_id: - T1562.008 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml b/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml index 386e50b65f..f71bac6e2a 100644 --- a/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml +++ b/detections/cloud/github_enterprise_pause_audit_log_event_stream.yml @@ -35,35 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Audit log event streaming is paused by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: Audit log event streaming is paused by $user$ mitre_attack_id: - T1562.008 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - user_agent - - reason - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_remove_organization.yml b/detections/cloud/github_enterprise_remove_organization.yml index 9feb1a4afc..e9f04b22c5 100644 --- a/detections/cloud/github_enterprise_remove_organization.yml +++ b/detections/cloud/github_enterprise_remove_organization.yml @@ -33,35 +33,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ removed an organization from GitHub Enterprise + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ removed an organization from GitHub Enterprise mitre_attack_id: - T1485 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_repository_archived.yml b/detections/cloud/github_enterprise_repository_archived.yml index 460576f5ff..f4b1f57ed2 100644 --- a/detections/cloud/github_enterprise_repository_archived.yml +++ b/detections/cloud/github_enterprise_repository_archived.yml @@ -36,37 +36,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ archived a repository in GitHub Enterprise + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ archived a repository in GitHub Enterprise mitre_attack_id: - T1485 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_enterprise_repository_deleted.yml b/detections/cloud/github_enterprise_repository_deleted.yml index 3adcec1f0e..d295127aa4 100644 --- a/detections/cloud/github_enterprise_repository_deleted.yml +++ b/detections/cloud/github_enterprise_repository_deleted.yml @@ -33,37 +33,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ deleted a repository in GitHub Enterprise + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ deleted a repository in GitHub Enterprise mitre_attack_id: - T1485 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_delete_branch_ruleset.yml b/detections/cloud/github_organizations_delete_branch_ruleset.yml index cfd7fbba77..01e4a24064 100644 --- a/detections/cloud/github_organizations_delete_branch_ruleset.yml +++ b/detections/cloud/github_organizations_delete_branch_ruleset.yml @@ -35,41 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ deleted a branch ruleset in repo $repo$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ deleted a branch ruleset in repo $repo$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - - name - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_disable_2fa_requirement.yml b/detections/cloud/github_organizations_disable_2fa_requirement.yml index de7c509c56..a2fcda1822 100644 --- a/detections/cloud/github_organizations_disable_2fa_requirement.yml +++ b/detections/cloud/github_organizations_disable_2fa_requirement.yml @@ -34,37 +34,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ disabled 2FA requirement in GitHub Organizations + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ disabled 2FA requirement in GitHub Organizations mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - user - - user_agent - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml b/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml index d03416df50..0847afd389 100644 --- a/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml +++ b/detections/cloud/github_organizations_disable_classic_branch_protection_rule.yml @@ -35,41 +35,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ disabled a classic branch protection rule in repo $repo$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ disabled a classic branch protection rule in repo $repo$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - - name - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_disable_dependabot.yml b/detections/cloud/github_organizations_disable_dependabot.yml index 7dd1bfe44e..b222d94020 100644 --- a/detections/cloud/github_organizations_disable_dependabot.yml +++ b/detections/cloud/github_organizations_disable_dependabot.yml @@ -33,40 +33,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Dependabot security features are disabled in repository $repo$ by $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: Dependabot security features are disabled in repository $repo$ by $user$ mitre_attack_id: - T1562.001 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_ip - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_repository_archived.yml b/detections/cloud/github_organizations_repository_archived.yml index e9758e8735..143b8274db 100644 --- a/detections/cloud/github_organizations_repository_archived.yml +++ b/detections/cloud/github_organizations_repository_archived.yml @@ -36,39 +36,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ archived a repository in GitHub Organizations + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ archived a repository in GitHub Organizations mitre_attack_id: - T1485 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - risk_score: 27 security_domain: network tests: - name: True Positive Test diff --git a/detections/cloud/github_organizations_repository_deleted.yml b/detections/cloud/github_organizations_repository_deleted.yml index b1502c663d..1074119a3e 100644 --- a/detections/cloud/github_organizations_repository_deleted.yml +++ b/detections/cloud/github_organizations_repository_deleted.yml @@ -36,39 +36,23 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $user$ deleted a repository in GitHub Organizations + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] tags: analytic_story: - GitHub Malicious Activity asset_type: GitHub - confidence: 90 - impact: 30 - message: $user$ deleted a repository in GitHub Organizations mitre_attack_id: - T1485 - observable: - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - actor - - actor_id - - actor_is_bot - - actor_location.country_code - - business - - business_id - - org - - org_id - - repo - - repo_id - - user - - user_agent - - user_id - risk_score: 27 security_domain: network tests: - name: True Positive Test