New GitHub Owner Added
editNew GitHub Owner Added
editDetects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it’s validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
Rule type: eql
Rule indices:
- logs-github.audit-*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References: None
Tags:
- Domain: Cloud
- Use Case: Threat Detection
- Use Case: UEBA
- Tactic: Persistence
- Data Source: Github
Version: 4
Rule authors:
- Elastic
Rule license: Elastic License v2
Rule query
editiam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin"
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
-
Technique:
- Name: Create Account
- ID: T1136
- Reference URL: https://attack.mitre.org/techniques/T1136/
-
Sub-technique:
- Name: Cloud Account
- ID: T1136.003
- Reference URL: https://attack.mitre.org/techniques/T1136/003/