GitHub Enterprise Audit: SSH Certificate Authority Config Change

title: "GitHub Enterprise Audit: SSH Certificate Authority Config Change"
id: c3a0a1ff-6635-43c8-b1bd-9474a20b6b14
status: test
description: This rule flags GitHub audit log events where an SSH certificate authority is created or where the requirement for using SSH certificates is disabled for organization access. Attackers may use changes to SSH certificate trust or authentication requirements to gain or maintain unauthorized access. It relies on GitHub audit log records capturing the specific SSH certificate authority creation and SSH certificate requirement disable actions.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_ssh_certificate_config_changed.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - ssh_certificate_authority.create
      - ssh_certificate_requirement.disable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef
    type: derived