detection.wiki

Public Key

actionDescriptionSampleRule
public_key.createAn SSH key was added to a user account or a deploy key was added to a repository.YY
public_key.deleteAn SSH key was removed from a user account or a deploy key was removed from a repository.YN
public_key.unverification_failureA user account's SSH key or a repository's deploy key was unable to be unverified.NN
public_key.unverifyA user account's SSH key or a repository's deploy key was unverified.NN
public_key.updateA user account's SSH key or a repository's deploy key was updated.NY
public_key.verification_failureA user account's SSH key or a repository's deploy key was unable to be verified.YN
public_key.verifyA user account's SSH key or a repository's deploy key was verified.YN

public_key.create

#
Category
public-key

Description

An SSH key was added to a user account or a deploy key was added to a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1772314639301,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAyNg==",
  "action": "public_key.create",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1772314639301,
  "fingerprint": "SHA256:rFN5aBcDEFgHijKLMnoPQrSTuVwXyz0123456789ABCDE",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwNAAAAAAAAAA=",
  "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWx9gXyUZEqZiWWIabJoC/G1zFgb42adP74SCjmYWUe",
  "oauth_application_id": 9200001,
  "operation_type": "create",
  "programmatic_access_type": "OAuth access token",
  "read_only": "false",
  "request_access_security_header": null,
  "request_id": "C194:3F46BD:FBB61D:126D2CF:69A3600F",
  "title": "GitHub CLI",
  "token_id": 9300000003,
  "token_scopes": "admin:public_key,gist,read:org,repo",
  "user": "user",
  "user_agent": "GitHub CLI 2.87.3",
  "user_id": 9000002
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

  • GitHub Repository Deploy Key Created Or Modified source high: Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.T1098↳ also matches public_key.update

Panther #

References #

public_key.delete

#
Category
public-key

Description

An SSH key was removed from a user account or a deploy key was removed from a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "org_id": 9000008,
  "repo_id": 9000217,
  "created_at": 1780149262214.0,
  "business_id": 9000005,
  "public_repo": false,
  "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWx9gXyUZEqZiWWIabJoC/G1zFgb42adP74SCjmYWUe",
  "org": "example-org",
  "repo": "user/example-repo",
  "title": "Example pull request title 1",
  "action": "public_key.delete",
  "business": "example-business",
  "read_only": "true",
  "explanation": "stale",
  "fingerprint": "SHA256:rFN5aBcDEFgHijKLMnoPQrSTuVwXyz0123456789ABCDE",
  "operation_type": "remove"
}

References #

public_key.unverification_failure

#
Category
public-key

Description

A user account's SSH key or a repository's deploy key was unable to be unverified.

Documented on GitHub's enterprise audit log reference.

public_key.unverify

#
Category
public-key

Description

A user account's SSH key or a repository's deploy key was unverified.

Documented on GitHub's enterprise audit log reference.

public_key.update

#
Category
public-key

Description

A user account's SSH key or a repository's deploy key was updated.

Documented on GitHub's enterprise audit log reference.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

  • GitHub Repository Deploy Key Created Or Modified source high: Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.T1098↳ also matches public_key.create

public_key.verification_failure

#
Category
public-key

Description

A user account's SSH key or a repository's deploy key was unable to be verified.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783910572273,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNjU=",
  "action": "public_key.verification_failure",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783910572273,
  "fingerprint": "SHA256:rFN5aBcDEFgHijKLMnoPQrSTuVwXyz0123456789ABCDE",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWx9gXyUZEqZiWWIabJoC/G1zFgb42adP74SCjmYWUe",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "read_only": "true",
  "repo": "user/example-repo",
  "repo_id": 9000009,
  "request_access_security_header": null,
  "request_id": "9518:205095:AB9DD16:AF6C821:6A5450AC",
  "title": "dw-harn-d0ca96a7-deploy-key",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user_agent": "python-requests/2.34.2"
}

References #

public_key.verify

#
Category
public-key

Description

A user account's SSH key or a repository's deploy key was verified.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1772314639305,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAyNw==",
  "action": "public_key.verify",
  "actor": "user",
  "actor_id": 9000002,
  "created_at": 1772314639305,
  "fingerprint": "SHA256:rFN5aBcDEFgHijKLMnoPQrSTuVwXyz0123456789ABCDE",
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwNAAAAAAAAAA=",
  "key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBWx9gXyUZEqZiWWIabJoC/G1zFgb42adP74SCjmYWUe",
  "oauth_application_id": 9200001,
  "operation_type": "modify",
  "programmatic_access_type": "OAuth access token",
  "read_only": "false",
  "request_access_security_header": null,
  "request_id": "C194:3F46BD:FBB61D:126D2CF:69A3600F",
  "title": "GitHub CLI",
  "token_id": 9300000003,
  "token_scopes": "admin:public_key,gist,read:org,repo",
  "user": "user",
  "user_agent": "GitHub CLI 2.87.3",
  "user_id": 9000002
}

References #