GitHub - Oauth application - a client secret was removed

Status: available
Severity: medium
Time window: 7d
Source: github.com/Azure/Azure-Sentinel

Detect activities when a client secret was removed. This query runs every day and its severity is Medium.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `oauth_application.remove_client_secret`: OAuth application secret key deleted

Rule body

id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c5
name: GitHub - Oauth application - a client secret was removed
description: |
  'Detect activities when a client secret was removed. This query runs every day and its severity is Medium.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
    GitHubAuditData
    | where Action == "oauth_application.remove_client_secret"
    | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "oauth_application.remove_client_secret"

Stage 3: `extend`

| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`oauth_application.remove_client_secret`	`field:"Action" kind:eq value:"oauth_application.remove_client_secret"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`