GitHub Audit: Secret Scanning Push Protection Bypass Event Detected

title: "GitHub Audit: Secret Scanning Push Protection Bypass Event Detected"
id: 8bea27c9-56b2-45a3-9b07-900db8a627cb
status: test
description: This rule flags GitHub audit events where the action indicates a secret scanning push protection bypass. Attackers could use this to circumvent repository protections for secrets, potentially enabling sensitive data exposure. It relies on GitHub audit log telemetry containing the specific action string for the bypass.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
  - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_push_protection_bypass_detected.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-03-07
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action|contains: secret_scanning_push_protection.bypass
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: low
license: DRL-1.1
related:
  - id: 02cf536a-cf21-4876-8842-4159c8aee3cc
    type: derived