GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled

title: "GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled"
id: c3a0a1ff-6635-43c8-b1bd-9474a20b6b14
status: test
description: This rule flags GitHub organization-level changes to SSH certificate access by detecting events where an SSH certificate authority is created or where the requirement to use SSH certificates is disabled. Attackers may use these modifications to broaden SSH access, introduce new trust anchors, or reduce enforcement, enabling stealthy persistence or privileged access. It relies on GitHub audit log events capturing the specific action names for SSH certificate authority creation and SSH certificate requirement disablement.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_ssh_certificate_config_changed.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - ssh_certificate_authority.create
      - ssh_certificate_requirement.disable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef
    type: derived