GitHub Audit: Secret Scanning Push Protection Bypass Activity Detected

title: "GitHub Audit: Secret Scanning Push Protection Bypass Activity Detected"
id: 8bea27c9-56b2-45a3-9b07-900db8a627cb
status: test
description: This rule flags GitHub audit log events where secret scanning push protection is bypassed. Attackers may use this to override protections after secrets are flagged, reducing the effectiveness of repository secret controls. The detection relies on the GitHub audit service event field matching the specific action string for push protection bypass.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
  - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_push_protection_bypass_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-03-07
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action|contains: secret_scanning_push_protection.bypass
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: low
license: DRL-1.1
related:
  - id: 02cf536a-cf21-4876-8842-4159c8aee3cc
    type: derived