Panther rules: github

def rule(event):

    return event.get("action").startswith("hook.")


def title(event):
    action = "modified"
    if event.get("action").endswith("destroy"):
        action = "deleted"
    elif event.get("action").endswith("create"):
        action = "created"
    return f"web hook {action} in repository [{event.get('repo','<UNKNOWN_REPO>')}]"


def severity(event):
    if event.get("action").endswith("create"):
        return "MEDIUM"
    return "INFO"

AnalysisType: rule
Filename: github_repo_hook_modified.py
RuleID: "GitHub.Repo.HookModified"
DisplayName: "DEPRECATED - GitHub Web Hook Modified"
Status: Deprecated
Enabled: false
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Exfiltration:Automated Exfiltration
  - Deprecated
Reports:
  MITRE ATT&CK:
    - TA0010:T1020
Reference: https://docs.github.com/en/webhooks/about-webhooks
Severity: Info
Description: Deprecated. See GitHub.Webhook.Modified instead.

import json
from unittest.mock import MagicMock

from panther_github_helpers import github_alert_context

# The keys for MONITORED_ACTIONS are gh_org/repo_name
# The values for MONITORED_ACTIONS are a list of ["action_names"]
MONITORED_ACTIONS = {}


def rule(event):

    global MONITORED_ACTIONS  # pylint: disable=global-statement
    if isinstance(MONITORED_ACTIONS, MagicMock):
        MONITORED_ACTIONS = json.loads(MONITORED_ACTIONS())  # pylint: disable=not-callable
    repo = event.get("repo", "")
    action_name = event.get("name", "")
    return all(
        [
            event.get("action", "") == "workflows.completed_workflow_run",
            event.get("conclusion", "") == "failure",
            repo in MONITORED_ACTIONS,
            action_name in MONITORED_ACTIONS.get(repo, []),
        ]
    )


def title(event):
    repo = event.get("repo", "<NO_REPO>")
    action_name = event.get("name", "<NO_ACTION_NAME>")
    return f"GitHub Action [{action_name}] in [{repo}] has failed"


def alert_context(event):
    a_c = github_alert_context(event)
    a_c["action"] = event.get("name", "<NO_ACTION_NAME>")
    a_c["action_run_link"] = (
        f"https://github.com/{a_c.get('repo')}/actions/"
        f"runs/{event.get('workflow_run_id', '<NO_RUN_ID>')}"
    )
    return a_c

AnalysisType: rule
Filename: github_action_failed.py
RuleID: "GitHub.Action.Failed"
DisplayName: "GitHub Action Failed"
Enabled: false
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Configuration Required
Severity: High
Description: A monitored github action has failed.
Runbook: |
  Inspect the action failure link and take appropriate response.
  There are no general plans of response for this activity.
Reference: https://docs.github.com/en/actions/creating-actions/setting-exit-codes-for-actions#about-exit-codes

AnalysisType: correlation_rule
RuleID: "GitHub.Advanced.Security.Change.NOT.FOLLOWED.BY.Repo.Archived"
DisplayName: "GitHub Advanced Security Change WITHOUT Repo Archived"
Enabled: false
Severity: Critical
Tags:
  - GitHub
  - Code Security
  - Defense Evasion
  - Configuration Change
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001
Description: >
  Identifies when GitHub Advanced Security (GHAS) settings are modified without the repository being archived within 90 minutes. GHAS provides code scanning, secret scanning, and dependency review to detect vulnerabilities and exposed credentials. Disabling GHAS while keeping repositories active suggests attackers hiding malicious code, preventing security alert detection, or facilitating backdoors and supply chain attacks.
Runbook: |
  1. Query GitHub audit logs for the repository in p_alert_context.repo in the 6 hours around the GHAS change to identify all commits, secret scanning alerts, code scanning alerts, and CI/CD configuration changes made by the user who disabled GHAS
  2. Review GitHub secret scanning history and code scanning alerts for the repository to check if new secrets or vulnerabilities were introduced around the time GHAS was disabled
  3. Check the user account's recent activity across all repositories in the organization audit log to identify if they made similar GHAS changes on other repositories or exhibited other suspicious behavior
Reference: https://docs.github.com/en/code-security/getting-started/auditing-security-alerts
Detection:
  - Group:
      - ID: GHASChange
        RuleID: GitHub.Advanced.Security.Change
      - ID: RepoArchived
        RuleID: Github.Repo.Archived
        Absence: true
    MatchCriteria: 
      field_name:
      - GroupID: GHASChange
        Match: p_alert_context.repo
      - GroupID: RepoArchived
        Match: p_alert_context.repo
    EventEvaluationOrder: Chronological
    LookbackWindowMinutes: 1800
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10

AnalysisType: correlation_rule
RuleID: "GitHub.ArtifactDownload.FROM.CrossFork.Workflow"
DisplayName: "GitHub Artifact Download from Cross-Fork Workflow"
Enabled: false
Severity: Medium
Tags:
  - CI/CD
  - Workflow
  - Supply Chain
  - Artifact Poisoning
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0002:T1072  # Execution: Software Deployment Tools
    - TA0004:T1134  # Privilege Escalation: Access Token Manipulation
Description: >
  The "download artifacts" API, and various custom actions encapsulating it,
  doesn't differentiate between artifacts that were uploaded by forked repositories 
  and base repositories, which could lead privileged workflows to download artifacts
  that were created by forked repositories and that are potentially poisoned.
Runbook: |
  1. Consider ensuring that the artifact download job uses the specific run_id for the generated artifact. 
     It is recommended to specify which run id or commit hash to download the artifact from.
  2. Consider filtering out artifacts created from pull requests.
  3. Consider limiting the possibility for outside collaborators to trigger workflows.
  4. Sanitize cross-fork contents.
Reference: https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust
Detection:
  - Group:
      - ID: CrossForkWorkflowRun
        RuleID: GitHub.CrossFork.Workflow.Run
      - ID: ArtifactDownload
        RuleID: GitHub.Webhook.WorkflowArtifactDownload
    MatchCriteria:
      field_name:
        - GroupID: CrossForkWorkflowRun
          Match: workflow_run.id
        - GroupID: ArtifactDownload
          Match: workflow_job.run_id
    EventEvaluationOrder: Chronological
    LookbackWindowMinutes: 1800
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 10

def rule(event):

    return event.get("action") == "protected_branch.destroy"


def title(event):
    return (
        f"A branch protection was removed from the "
        f"repository [{event.get('repo', '<UNKNOWN_REPO>')}] "
        f"by [{event.get('actor', '<UNKNOWN_ACTOR>')}]"
    )

AnalysisType: rule
Filename: github_branch_protection_disabled.py
RuleID: "GitHub.Branch.ProtectionDisabled"
DisplayName: "GitHub Branch Protection Disabled"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: High
Description: Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.
Runbook: Verify that branch protection should be disabled on the repository and re-enable as necessary.
Reference: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule

def rule(event):

    return event.get("action") == "protected_branch.policy_override"


def title(event):
    branch = event.get("branch", "<UNKNOWN_BRANCH>")
    return (
        f"A branch protection requirement in the repository"
        f" [{event.get('repo', '<UNKNOWN_REPO>')}]"
        f" was overridden by user [{event.udm('actor_user')}]"
        f" on branch [{branch}]"
    )

AnalysisType: rule
Filename: github_branch_policy_override.py
RuleID: "GitHub.Branch.PolicyOverride"
DisplayName: "GitHub Branch Protection Policy Override"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: High
Description: Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.
Runbook: Verify that the GitHub admin performed this activity and validate its use.
Reference: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule

import re

from panther_github_helpers import github_reference_url, github_webhook_alert_context

SKIP_PATTERNS = [
    r"\[skip ci\]",
    r"\[ci skip\]",
    r"\[no ci\]",
    r"\[skip actions\]",
    r"\[actions skip\]",
    r"skip-checks:\s*true",
]

COMPILED_PATTERNS = [re.compile(pattern, re.IGNORECASE) for pattern in SKIP_PATTERNS]


def rule(event):
    if not event.get("pusher"):
        return False

    repo = event.get("repository", {})
    if repo.get("private") or not repo.get("allow_forking"):
        return False

    messages = event.deep_walk("commits", "message")
    if not isinstance(messages, list):
        messages = [messages]

    for message in messages:
        if _has_skip_pattern(message):
            return True

    return False


def _has_skip_pattern(message):
    if not message:
        return False

    return any(pattern.search(message) for pattern in COMPILED_PATTERNS)


def title(event):
    repo_name = event.deep_get("repository", "full_name", default="<UNKNOWN_REPO>")
    head_commit = event.deep_get("head_commit", default={})
    commit_sha = head_commit.get("id", "<NO_SHA>")[:8]

    return f"Cross-fork workflow skip commit detected in {repo_name} ({commit_sha})"


def alert_context(event):
    context = github_webhook_alert_context(event)

    skip_commits = []

    commits = event.get("commits", [{}])
    for commit in commits:
        commit_message = commit.get("message", "")
        if _has_skip_pattern(commit_message):
            matched_patterns = [
                SKIP_PATTERNS[i]
                for i, pattern in enumerate(COMPILED_PATTERNS)
                if pattern.search(commit_message)
            ]

            skip_commits.append(
                {
                    "id": commit.get("id"),
                    "message": commit_message,
                    "author": commit.get("author", {}).get("name"),
                    "matched_patterns": matched_patterns,
                }
            )

    context["skip_commits"] = skip_commits

    return context


def reference(event):
    if reference_url := github_reference_url(event):
        return reference_url

    return "DEFAULT"

AnalysisType: rule
Filename: github_workflow_skip_commits.py
RuleID: "GitHub.Webhook.WorkflowSkipCommits"
DisplayName: "GitHub Commits Skipping Workflows"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0005:T1622  # Defense Evasion: Debugger Evasion
Tags:
  - CI/CD
  - Workflow
Severity: Medium
Description: >
  Detects commits from cross-fork scenarios that contain workflow skip directives, which bypass GitHub Actions workflows.
  These skip patterns ([skip ci], [ci skip], [no ci], [skip actions], [actions skip], skip-checks:true)
  can be used to avoid security checks and CI/CD processes. This rule only alerts on commits to public forkable repositories.
Runbook: >
  1. Review the commit message and author to determine if the workflow skip was intentional and authorized
  2. Verify that skipping workflows is appropriate for the type of changes made
  3. Check if the repository has policies requiring workflow runs for certain changes
  4. Consider if the skip bypasses important security or quality checks
  5. Monitor for patterns of excessive workflow skipping that might indicate policy circumvention
Reference: https://docs.github.com/en/actions/managing-workflow-runs/skipping-workflow-runs

from panther_base_helpers import deep_get
from panther_github_helpers import is_cross_fork_pr


def rule(event):
    return (
        event.deep_get("workflow_run", "event") in ("pull_request_target", "pull_request")
        and event.get("action") == "requested"
        and is_cross_fork_pr(event) is True
    )


def title(event):
    workflow_name = event.deep_get("workflow_run", "name", default="<UNKNOWN_WORKFLOW>")
    repo_name = deep_get(event, "repository", "full_name", default="<UNKNOWN_REPO>")
    action = event.get("action", "<UNKNOWN_ACTION>")

    title_str = f"Workflow [{workflow_name}] triggered by cross-fork PR in {repo_name} ({action})"
    return title_str

AnalysisType: rule
Filename: github_crossfork_workflow_run.py
RuleID: "GitHub.CrossFork.Workflow.Run"
DisplayName: "GitHub Cross-Fork Workflow Run"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0002:T1072  # Execution: Software Deployment Tools
    - TA0004:T1134 # Privilege Escalation: Access Token Manipulation
Tags:
  - CI/CD
  - Workflow
CreateAlert: false
Severity: Info
Description: Tracks workflows run in cross-fork pull requests.
Reference: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows

from panther_github_helpers import github_alert_context


def rule(event):
    if event.get("action") == "repository_vulnerability_alert.dismiss":
        return True
    return False


def title(event):
    return f"GitHub Dependabot Vulnerability Dismissed by {event.get('actor')}: {event.get('repo')}"


def alert_context(event):
    context = github_alert_context(event)
    alert_url = (
        f"https://github.com/{event.get('repo')}/security/dependabot/{event.get('alert_number')}"
    )
    return context | {"alert_url": alert_url}

AnalysisType: rule
DisplayName: "GitHub Dependabot Vulnerability Dismissed" 
Enabled: true
Filename: github_repo_vulnerability_dismissed.py
RuleID: "Github.Repo.VulnerabilityDismissed"
Severity: High
Threshold: 1
Description: >
  Creates an alert if a dependabot alert is dismissed without being fixed.
LogTypes:
  - GitHub.Audit

from panther_github_helpers import (
    contains_bash_injection_pattern,
    get_matched_bash_patterns,
    github_reference_url,
    github_webhook_alert_context,
)


def rule(event):
    # Check for comment/review events
    action = event.get("action")

    # Handle issue_comment events (comments on issues or PRs)
    if event.get("comment") and action in ["created", "edited"]:
        if contains_bash_injection_pattern(event.deep_get("comment", "body")):
            return True

    # Handle pull_request_review events
    if event.get("review") and action in ["submitted", "edited"]:
        if contains_bash_injection_pattern(event.deep_get("review", "body")):
            return True
    return False


def title(event):
    repo_name = event.deep_get("repository", "full_name", default="<UNKNOWN_REPO>")
    action = event.get("action", "<UNKNOWN_ACTION>")

    # Determine if this is a comment or review
    if event.get("comment"):
        comment_id = event.deep_get("comment", "id", default="<UNKNOWN>")
        comment_type = "PR comment" if event.get("pull_request") else "issue comment"
        return (
            f"Malicious pattern detected in {comment_type} #{comment_id} in {repo_name} ({action})"
        )
    if event.get("review"):
        review_id = event.deep_get("review", "id", default="<UNKNOWN>")
        return f"Malicious pattern detected in PR review #{review_id} in {repo_name} ({action})"

    return f"Malicious pattern detected in comment/review in {repo_name} ({action})"


def alert_context(event):
    context = github_webhook_alert_context(event)

    # Analyze comment body
    if comment_body := event.deep_get("comment", "body"):
        patterns = get_matched_bash_patterns(comment_body)
        if patterns:
            comment = event.get("comment", {})
            context["comment_analysis"] = {
                "body": comment_body,
                "matched_patterns": patterns,
                "comment_id": comment.get("id"),
                "user": comment.get("user", {}).get("login"),
                "html_url": comment.get("html_url"),
                "created_at": comment.get("created_at"),
                "updated_at": comment.get("updated_at"),
            }

    # Analyze review body
    if review_body := event.deep_get("review", "body"):
        patterns = get_matched_bash_patterns(review_body)
        if patterns:
            review = event.get("review", {})
            context["review_analysis"] = {
                "body": review_body,
                "matched_patterns": patterns,
                "review_id": review.get("id"),
                "user": review.get("user", {}).get("login"),
                "state": review.get("state"),
                "html_url": review.get("html_url"),
                "submitted_at": review.get("submitted_at"),
            }

    return context


def reference(event):
    # Try to get comment or review URL
    if comment_url := event.deep_get("comment", "html_url"):
        return comment_url

    if review_url := event.deep_get("review", "html_url"):
        return review_url

    if reference_url := github_reference_url(event):
        return reference_url

    return "DEFAULT"

AnalysisType: rule
Filename: github_malicious_comment_content.py
RuleID: "GitHub.Webhook.MaliciousCommentContent"
DisplayName: "GitHub Malicious Comment/Review Content"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0042:T1566  # Initial Access: Phishing
Tags:
  - Code Injection
  - Supply Chain
  - Social Engineering
Severity: Medium
Description: >
  Detects malicious patterns in GitHub comment and review content that could indicate bash
  injection attempts or social engineering attacks. This includes comments on issues, pull
  requests, and pull request reviews. While comments cannot directly execute code, they can
  be used to trick developers into running malicious commands. This rule detects command
  substitution patterns similar to those found in the Nx vulnerability (GHSA-cxm3-wv7p-598c).
Runbook: |
  1. Review the comment or review content for malicious patterns
  2. Check the author's profile and activity history
  3. Determine if this is a legitimate comment or a social engineering attempt
  4. Delete the comment/review if it's malicious
  5. Report the user if they appear to be intentionally posting malicious content
  6. Review other comments from the same user in the repository
  7. Consider blocking the user from the repository/organization
  8. Check if any developers may have already executed the malicious commands
Reference: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

from panther_github_helpers import (
    contains_bash_injection_pattern,
    get_matched_bash_patterns,
    github_reference_url,
    github_webhook_alert_context,
)


def rule(event):
    # Check for push events with commits
    if not (event.get("commits") or event.get("head_commit")):
        return False

    # Check head_commit fields (single commit in push)
    if head_commit := event.get("head_commit"):
        fields_to_check = [
            head_commit.get("message"),
            head_commit.get("author", {}).get("email"),
            head_commit.get("author", {}).get("name"),
        ]
        for field in fields_to_check:
            if contains_bash_injection_pattern(field):
                return True

    # Check all commits in the push
    for commit in event.get("commits", []):
        commit_fields = [
            commit.get("message"),
            commit.get("author", {}).get("email"),
            commit.get("author", {}).get("name"),
        ]
        for field in commit_fields:
            if contains_bash_injection_pattern(field):
                return True

    return False


def title(event):
    repo_name = event.deep_get("repository", "full_name", default="<UNKNOWN_REPO>")
    ref = event.get("ref", "<UNKNOWN_REF>")

    return f"Malicious pattern detected in commit content in {repo_name} on {ref}"


def alert_context(event):
    context = github_webhook_alert_context(event)

    context["malicious_commits"] = []

    # Analyze head_commit
    if head_commit := event.get("head_commit"):
        commit_analysis = _analyze_commit(head_commit)
        if commit_analysis["has_malicious_patterns"]:
            context["malicious_commits"].append(commit_analysis)

    # Analyze all commits
    for commit in event.get("commits", []):
        commit_analysis = _analyze_commit(commit)
        if commit_analysis["has_malicious_patterns"]:
            context["malicious_commits"].append(commit_analysis)

    return context


def _analyze_commit(commit):
    """Analyze a single commit for malicious patterns."""
    analysis = {
        "commit_id": commit.get("id"),
        "message": commit.get("message"),
        "author": commit.get("author", {}).get("name"),
        "author_email": commit.get("author", {}).get("email"),
        "timestamp": commit.get("timestamp"),
        "url": commit.get("url"),
        "has_malicious_patterns": False,
        "field_analysis": {},
    }

    # Check message
    if message := commit.get("message"):
        patterns = get_matched_bash_patterns(message)
        if patterns:
            analysis["has_malicious_patterns"] = True
            analysis["field_analysis"]["message"] = {
                "value": message,
                "matched_patterns": patterns,
            }

    # Check author email
    if author_email := commit.get("author", {}).get("email"):
        patterns = get_matched_bash_patterns(author_email)
        if patterns:
            analysis["has_malicious_patterns"] = True
            analysis["field_analysis"]["author_email"] = {
                "value": author_email,
                "matched_patterns": patterns,
            }

    # Check author name
    if author_name := commit.get("author", {}).get("name"):
        patterns = get_matched_bash_patterns(author_name)
        if patterns:
            analysis["has_malicious_patterns"] = True
            analysis["field_analysis"]["author_name"] = {
                "value": author_name,
                "matched_patterns": patterns,
            }

    return analysis


def reference(event):
    # Try to get the compare URL
    if compare_url := event.get("compare"):
        return compare_url

    # Try head commit URL
    if head_commit_url := event.deep_get("head_commit", "url"):
        return head_commit_url

    if reference_url := github_reference_url(event):
        return reference_url

    return "DEFAULT"

AnalysisType: rule
Filename: github_malicious_commit_content.py
RuleID: "GitHub.Webhook.MaliciousCommitContent"
DisplayName: "GitHub Malicious Commit Content"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0003:T1098  # Persistence: Account Manipulation
Tags:
  - Code Injection
  - Supply Chain
  - Account Compromise
Severity: High
Description: >
  Detects malicious patterns in GitHub commit content including commit messages, author names,
  and author emails. These fields can contain injection payloads that may be executed by
  vulnerable CI/CD workflows or git hooks. This rule is particularly important as commit metadata
  is often trusted and may be processed unsafely. Based on patterns from the Nx vulnerability
  (GHSA-cxm3-wv7p-598c).
Runbook: |
  1. Immediately investigate the commits identified with malicious patterns
  2. Check if the author account may be compromised
  3. Review all workflows and git hooks that process commit messages or author information
  4. Look for signs of code execution in CI/CD logs
  5. Revert malicious commits if confirmed
  6. Reset credentials if the author account is compromised
  7. Review repository access logs for suspicious activity
  8. Consider temporarily disabling vulnerable workflows
  9. Implement input sanitization for commit metadata processing
  10. Contact the repository owner and security team
Reference: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

from panther_github_helpers import (
    contains_bash_injection_pattern,
    get_matched_bash_patterns,
    github_reference_url,
    github_webhook_alert_context,
)


def rule(event):
    # Check if this is an issue event (opened or edited) and that it's open
    is_issue_event = (
        event.get("issue")
        and event.get("action") in ["opened", "edited"]
        and event.deep_get("issue", "state") == "open"
    )

    # Check if this is a pages/wiki event (Gollum event)
    has_pages = event.get("pages")

    if not is_issue_event and not has_pages:
        return False

    # Check issue fields if this is an issue event
    if is_issue_event:
        fields_to_check = [
            event.deep_get("issue", "title"),
            event.deep_get("issue", "body"),
        ]

        for field in fields_to_check:
            if contains_bash_injection_pattern(field):
                return True

    # Check pages (for GitHub wiki/Gollum events)
    for page in event.get("pages", []):
        if contains_bash_injection_pattern(page.get("page_name")):
            return True

    return False


def title(event):
    repo_name = event.deep_get("repository", "full_name", default="<UNKNOWN_REPO>")

    # If this is an issue event
    if event.get("issue"):
        issue_number = event.deep_get("issue", "number", default="<UNKNOWN_ISSUE_NUMBER>")
        user = event.deep_get("issue", "user", "login", default="<UNKNOWN_USER>")
        return (
            f"Malicious pattern detected in issue #{issue_number} in {repo_name} by user [{user}]"
        )

    # If this is a pages/wiki event
    if event.get("pages"):
        return f"Malicious pattern detected in wiki page in {repo_name}"

    return f"Malicious pattern detected in {repo_name}"


def alert_context(event):
    context = github_webhook_alert_context(event)

    # Analyze patterns found in issue fields if this is an issue event
    if event.get("issue"):
        issue_fields = {
            "title": event.deep_get("issue", "title"),
            "body": event.deep_get("issue", "body"),
        }

        context["field_analysis"] = {}
        for field_name, field_value in issue_fields.items():
            patterns = get_matched_bash_patterns(field_value)
            if patterns:
                context["field_analysis"][field_name] = {
                    "value": field_value,
                    "matched_patterns": patterns,
                }

        # Add issue details
        issue = event.get("issue", {})
        context["issue"] = {
            "number": issue.get("number"),
            "title": issue.get("title"),
            "state": issue.get("state"),
            "user": issue.get("user", {}).get("login"),
            "html_url": issue.get("html_url"),
            "created_at": issue.get("created_at"),
            "updated_at": issue.get("updated_at"),
        }

    # Analyze pages (for wiki/Gollum events)
    context["malicious_pages"] = []
    for page in event.get("pages", []):
        if page_name := page.get("page_name"):
            patterns = get_matched_bash_patterns(page_name)
            if patterns:
                context["malicious_pages"].append(
                    {
                        "page_name": page_name,
                        "action": page.get("action"),
                        "title": page.get("title"),
                        "html_url": page.get("html_url"),
                        "matched_patterns": patterns,
                    }
                )

    return context


def reference(event):
    # Try to get the issue URL
    issue_url = event.deep_get("issue", "html_url")
    if issue_url:
        return issue_url

    # Try to get a page URL if this is a pages/wiki event
    if pages := event.get("pages"):
        if pages and len(pages) > 0 and pages[0].get("html_url"):
            return pages[0].get("html_url")

    if reference_url := github_reference_url(event):
        return reference_url

    return "DEFAULT"

AnalysisType: rule
Filename: github_malicious_issue_pages.py
RuleID: "GitHub.Webhook.MaliciousIssuePagesContent"
DisplayName: "GitHub Malicious Issue/Pages Content"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0002:T1072  # Execution: Software Deployment Tools
Tags:
  - Code Injection
  - Supply Chain
  - Social Engineering
Severity: Medium
Description: >
  Detects malicious patterns in GitHub issue content (title and body) and GitHub wiki pages (page names)
  that could indicate bash injection attempts. This rule detects command substitution patterns similar
  to those found in the Nx vulnerability (GHSA-cxm3-wv7p-598c). Covers both issue events and Gollum
  (wiki) events.
Runbook: |
  1. Review the issue or wiki page content for malicious patterns
  2. For issues: Check the issue author's profile and activity history
  3. For wiki pages: Check the page author and page edit history
  4. Determine if the content is legitimate or malicious
  5. Close and lock the issue if it's malicious, or revert wiki page edits
  6. Report the user if they appear to be intentionally posting malicious content
  7. Review recent activity from the same user in other repositories
  8. Consider blocking the user from the repository/organization
  9. Review CI/CD workflows that may process issue or wiki content
Reference: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

from panther_github_helpers import (
    contains_bash_injection_pattern,
    get_matched_bash_patterns,
    github_reference_url,
    github_webhook_alert_context,
    is_cross_fork_pr,
    is_pull_request_event,
)


def rule(event):
    if not is_pull_request_event(event) or event.deep_get("action") != "opened":
        return False

    # Check all untrusted PR-related inputs
    fields_to_check = [
        event.deep_get("pull_request", "title"),
        event.deep_get("pull_request", "body"),
        event.deep_get("pull_request", "head", "ref"),
        event.deep_get("pull_request", "head", "label"),
        event.deep_get("pull_request", "head", "repo", "default_branch"),
    ]

    for field in fields_to_check:
        if contains_bash_injection_pattern(field):
            return True

    return False


def title(event):
    pr_number = event.deep_get("pull_request", "number", default="<UNKNOWN>")
    repo_name = event.deep_get("repository", "full_name", default="<UNKNOWN_REPO>")
    action = event.get("action", "<UNKNOWN_ACTION>")

    return f"Malicious pattern detected in PR #{pr_number} in {repo_name} ({action})"


def alert_context(event):
    context = github_webhook_alert_context(event)

    # Analyze patterns found in all PR fields
    pr_fields = {
        "title": event.deep_get("pull_request", "title"),
        "body": event.deep_get("pull_request", "body"),
        "head_ref": event.deep_get("pull_request", "head", "ref"),
        "head_label": event.deep_get("pull_request", "head", "label"),
        "head_repo_default_branch": event.deep_get(
            "pull_request", "head", "repo", "default_branch"
        ),
    }

    context["field_analysis"] = {}
    for field_name, field_value in pr_fields.items():
        patterns = get_matched_bash_patterns(field_value)
        if patterns:
            context["field_analysis"][field_name] = {
                "value": field_value,
                "matched_patterns": patterns,
            }

    return context


def reference(event):
    if reference_url := github_reference_url(event):
        return reference_url

    return "DEFAULT"


def severity(event):
    if is_cross_fork_pr(event):
        return "DEFAULT"

    return "LOW"

AnalysisType: rule
Filename: github_malicious_pr_titles.py
RuleID: "GitHub.Webhook.MaliciousPRTitles"
DisplayName: "GitHub Malicious Pull Request Content"
Enabled: true
LogTypes:
  - GitHub.Webhook
Reports:
  MITRE ATT&CK:
    - TA0001:T1195.002  # Supply Chain Compromise: Compromise Software Supply Chain
    - TA0002:T1072  # Execution: Software Deployment Tools
Tags:
  - Code Injection
  - Supply Chain
Severity: High
Description: >
  Detects malicious patterns in GitHub pull request content (title, body, head ref, head label,
  default branch) that could indicate bash injection attempts or other malicious activity.
  This rule is designed to catch attacks like the Nx vulnerability (GHSA-cxm3-wv7p-598c) where
  PR titles contained bash injection payloads that could be executed by vulnerable CI workflows.
  Lower severity for PRs that are not cross-fork.
Runbook: |
  1. Immediately review the pull request content and metadata for malicious patterns
  2. Check if the repository has workflows that process PR titles or descriptions unsafely
  3. Verify the identity and legitimacy of the PR author, especially for cross-fork PRs
  4. Review recent workflow runs for signs of code execution or compromise
  5. Check for any unusual repository activity or file modifications
  6. Consider temporarily disabling vulnerable workflows until they can be secured
  7. Implement input sanitization and use pull_request instead of pull_request_target
  8. Report suspected supply chain attacks to security team
Reference: https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

AUTH_CHANGE_EVENTS = [
    "org.saml_disabled",
    "org.saml_enabled",
    "org.disable_two_factor_requirement",
    "org.enable_two_factor_requirement",
    "org.update_saml_provider_settings",
    "org.enable_oauth_app_restrictions",
    "org.disable_oauth_app_restrictions",
]


def rule(event):

    if not event.get("action").startswith("org."):
        return False

    return event.get("action") in AUTH_CHANGE_EVENTS


def title(event):
    return f"GitHub auth configuration was changed by {event.get('actor', '<UNKNOWN USER>')}"

AnalysisType: rule
Filename: github_org_auth_modified.py
RuleID: "GitHub.Org.AuthChange"
DisplayName: "GitHub Org Authentication Method Changed"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence
  - Account Manipulation
  - Identity and Access Management
  - Security Configuration
  - Privilege Escalation
  - Defense Evasion
  - Organization Security
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Severity: Critical
SummaryAttributes:
  - actor
  - action
Description: >
  Detects critical changes to GitHub organization authentication settings including SAML SSO, 2FA requirements, SAML provider configuration, and OAuth restrictions. These foundational security controls protect entire organizations, and unauthorized modifications can enable attackers to bypass identity management, maintain persistence, or prepare for data exfiltration. Legitimate changes are rare and should be well-documented with proper authorization.
Runbook: |
  1. Query GitHub audit logs for all actions by the actor in the 48 hours around this authentication change to identify other suspicious activities such as adding organization members, creating personal access tokens, modifying repository permissions, or accessing private repositories
  2. Review the organization membership changes, team permission modifications, and repository access grants in the 6 hours around this event to determine if the actor used elevated access to establish additional persistence mechanisms
  3. Check GitHub audit logs for authentication failures, suspicious login locations, or unusual access patterns from the actor's account in the 7 days before this change that might indicate account compromise
Reference: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github

ALLOWLIST_ACTIONS = [
    "ip_allow_list.enable",
    "ip_allow_list.disable",
    "ip_allow_list.enable_for_installed_apps",
    "ip_allow_list.disable_for_installed_apps",
    "ip_allow_list_entry.create",
    "ip_allow_list_entry.update",
    "ip_allow_list_entry.destroy",
]


def rule(event):

    return (
        event.get("action").startswith("ip_allow_list") and event.get("action") in ALLOWLIST_ACTIONS
    )


def title(event):
    return f"GitHub Org IP Allow list modified by {event.get('actor')}."

AnalysisType: rule
Filename: github_org_ip_allowlist.py
RuleID: "GitHub.Org.IpAllowlist"
DisplayName: "GitHub Org IP Allow List modified"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence:Account Manipulation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Severity: Medium
SummaryAttributes:
  - actor
  - action
Description: Detects changes to a GitHub Org IP Allow List
Runbook: Verify that the change was authorized and appropriate.
Reference: https://docs.github.com/en/apps/maintaining-github-apps/managing-allowed-ip-addresses-for-a-github-app

from panther_github_helpers import github_alert_context


def rule(event):

    # Return True to match the log event and trigger an alert.
    # Creates a new alert if the event's action was ""
    return event.get("action") == "integration_installation.create"


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method
    # will act as deduplication string.
    return (
        f" Github User [{event.get('actor',{})}] in [{event.get('org')}] "
        f"installed the following integration: [{event.get('name')}]."
    )


# def dedup(event):
#  (Optional) Return a string which will be used to deduplicate similar alerts.
# return ''


def alert_context(event):
    #  (Optional) Return a dictionary with additional data to be included in the
    #  alert sent to the SNS/SQS/Webhook destination
    return github_alert_context(event)

AnalysisType: rule
Description: An application integration was installed to your organization's Github account by someone in your organization.
DisplayName: "Github Organization App Integration Installed"
Enabled: true
Filename: github_organization_app_integration_installed.py
Reference: https://docs.github.com/en/enterprise-server@3.4/developers/apps/managing-github-apps/installing-github-apps
Runbook: Confirm that the app integration installation was a desired behavior.
Severity: Low
Tags:
  - Application Installation
  - Github
DedupPeriodMinutes: 60
LogTypes:
  - GitHub.Audit
RuleID: "Github.Organization.App.Integration.Installed"
SummaryAttributes:
  - actor
  - name
Threshold: 1

from panther_github_helpers import github_alert_context


def rule(event):

    # Return True if a public repository was created
    return event.get("action", "") == "repo.create" and event.get("visibility", "") == "public"


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method
    # will act as deduplication string.
    return (
        f"Repository [{event.get('repo', '<UNKNOWN_REPO>')}] "
        f"created with public status by Github user [{event.get('actor')}]."
    )


# def dedup(event):
#  (Optional) Return a string which will be used to deduplicate similar alerts.
# return ''


def alert_context(event):
    #  (Optional) Return a dictionary with additional data to be included in the alert
    # sent to the SNS/SQS/Webhook destination
    return github_alert_context(event)

AnalysisType: rule
Description: A public Github repository was created.
DisplayName: "Github Public Repository Created"
Enabled: true
Filename: github_public_repository_created.py
Runbook: Confirm this github repository was intended to be created as 'public' versus 'private'.
Reference: https://docs.github.com/en/get-started/quickstart/create-a-repo
Severity: Medium
Tags:
  - Github Repository
  - Public
  - Repository Created
DedupPeriodMinutes: 60
LogTypes:
  - GitHub.Audit
RuleID: "Github.Public.Repository.Created"
SummaryAttributes:
  - actor
  - repository
  - visibility
Threshold: 1