detection.wiki

Repository Secret Scanning

actionDescriptionSampleRule
repository_secret_scanning.disableSecret scanning was disabled for a repository.YY
repository_secret_scanning.enableSecret scanning was enabled for a repository.YN

repository_secret_scanning.disable

#
Category
repository-secret-scanning

Description

Secret scanning was disabled for a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783910558335,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwNzk=",
  "action": "repository_secret_scanning.disable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783910558335,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000011,
  "request_access_security_header": null,
  "request_id": "94D6:32DEEF:B396FFB:B767A2C:6A54509E",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GitHub Secret Scanning Disabled source low: Detects when GitHub Secret Scanning is disabled for a repository. Adversaries may disable secret scanning to evade detection of hardcoded secrets, such as API keys or credentials, that could be used for further compromise or data exfiltration.T1562, T1562.001

YARA-L #

repository_secret_scanning.enable

#
Category
repository-secret-scanning

Description

Secret scanning was enabled for a repository.

Documented on GitHub's enterprise audit log reference.

Example Audit Log Entry #

{
  "@timestamp": 1783910556986,
  "_document_id": "U1lOX0RPQ18wMDAwMDAwMDAwMDAwODI=",
  "action": "repository_secret_scanning.enable",
  "actor": "user",
  "actor_id": 9000002,
  "actor_is_bot": false,
  "actor_location": {
    "country_code": "XX"
  },
  "business": "example-business",
  "business_id": 9000003,
  "created_at": 1783910556986,
  "hashed_token": "U1lOVEhFVElDX1RPS0VOX0hBU0hfMDAwMQ==",
  "operation_type": "modify",
  "org": "example-org",
  "org_id": 9000004,
  "programmatic_access_type": "Personal access token (classic)",
  "public_repo": false,
  "repo": "user/example-repo",
  "repo_id": 9000011,
  "request_access_security_header": null,
  "request_id": "94D6:32DEEF:B396885:B7672A6:6A54509C",
  "token_id": 9000006,
  "token_scopes": "admin:enterprise,admin:gpg_key,admin:org,admin:org_hook,admin:public_key,admin:repo_hook,admin:ssh_signing_key,audit_log,codespace,copilot,delete:packages,delete_repo,gist,notifications,project,repo,user,workflow,write:discussion,write:network_configurations,write:packages",
  "user": "user",
  "user_agent": "python-requests/2.34.2",
  "user_id": 9000002
}

References #