GitHub Secret Scanning Disabled for Enterprise or Repository

title: GitHub Secret Scanning Disabled for Enterprise or Repository
id: c361b322-ac62-4359-8156-8a04ec2361fd
status: test
description: This rule identifies audit actions that disable secret scanning for an entire enterprise or for new/existing repositories. Attackers can reduce exposure by turning off secret scanning, delaying detection and increasing the likelihood that credentials and other sensitive data remain undetected. It relies on GitHub audit log events containing the specific secret scanning disable action names.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_secret_scanning_feature_disabled.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-03-07
modified: 2024-07-19
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - business_secret_scanning.disable
      - business_secret_scanning.disabled_for_new_repos
      - repository_secret_scanning.disable
      - secret_scanning_new_repos.disable
      - secret_scanning.disable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: high
license: DRL-1.1
related:
  - id: 3883d9a0-fd0f-440f-afbb-445a2a799bb8
    type: derived