GitHub Secret Scanning Disabled Audit Actions for Enterprise or Repository

title: GitHub Secret Scanning Disabled Audit Actions for Enterprise or Repository
id: c361b322-ac62-4359-8156-8a04ec2361fd
status: test
description: This rule identifies GitHub audit events where secret scanning is disabled, including disabling it entirely, disabling it for new repositories, or disabling repository secret scanning. Attackers may attempt to reduce detection coverage by turning off scanning for secrets that could otherwise trigger alerts. The detection relies on GitHub audit log events with specific action names indicating secret scanning disablement.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_secret_scanning_feature_disabled.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-03-07
modified: 2024-07-19
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - business_secret_scanning.disable
      - business_secret_scanning.disabled_for_new_repos
      - repository_secret_scanning.disable
      - secret_scanning_new_repos.disable
      - secret_scanning.disable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: high
license: DRL-1.1
related:
  - id: 3883d9a0-fd0f-440f-afbb-445a2a799bb8
    type: derived