GitHub Audit: New Actions Secret Created (Organization, Environment, Codespaces, or Repository)

title: "GitHub Audit: New Actions Secret Created (Organization, Environment, Codespaces, or Repository)"
id: 32a4c8c1-5e9e-4132-be35-0fbe721b524e
status: test
description: This rule flags when an actor creates a new GitHub Actions secret for an organization, an environment, Codespaces, or a repository. Creating secrets is security-sensitive because newly added values can be used by workflows to enable access, persistence, or stealthy execution. It relies on GitHub audit log events indicating the specific secret-creation action type.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-20
references:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_secret_created.yml
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - codespaces.create_an_org_secret
      - environment.create_actions_secret
      - org.create_actions_secret
      - repo.create_actions_secret
  condition: selection
falsepositives:
  - This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the "actor".
level: low
license: DRL-1.1
related:
  - id: f9405037-bc97-4eb7-baba-167dad399b83
    type: derived