GitHub - Repository was created

Status: available
Severity: medium
Time window: 7d
Source: github.com/Azure/Azure-Sentinel

Detect activities when a repository was created. This query runs every day and its severity is Medium.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `repo.create`: Repository created

Rules detecting the same action

These rules filter on the same operation.

Github Public Repository Created (Panther)
GitHub Repo Created (Elastic)
GitHub Repository Created (Panther)
NX Supply Chain - S1ngularity Repository Detection (Panther)

Rule body

id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c2
name: GitHub - Repository was created
description: |
  'Detect activities when a repository was created. This query runs every day and its severity is Medium.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
    GitHubAuditData
    | where Action == "repo.create"
    | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "repo.create"

Stage 3: `extend`

| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`repo.create`	`field:"Action" kind:eq value:"repo.create"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`