detection.wiki

Detection rules › Panther

GitHub User Added to Org Moderators

Severity
medium
Log types
GitHub.Audit
Tags
GitHub, Initial Access:Supply Chain Compromise
Reference
https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-moderators-in-your-organization
Source
github.com/panther-labs/panther-analysis

Detects when a user is added to a GitHub org's list of moderators.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessNo specific technique

Rule body yaml

AnalysisType: rule
Filename: github_org_moderators_add.py
RuleID: "GitHub.Org.Moderators.Add"
DisplayName: "GitHub User Added to Org Moderators"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Severity: Medium
Description: Detects when a user is added to a GitHub org's list of moderators.
Reference: https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-moderators-in-your-organization
Tests:
  - Name: GitHub - Org Moderator Added
    ExpectedResult: true
    Log:
      {
        "_document_id": "Ab123",
        "action": "organization_moderators.add_user",
        "actor": "sarah78",
        "actor_location": { "country_code": "US" },
        "at_sign_timestamp": "2022-12-11 05:17:28.078",
        "created_at": "2022-12-11 05:17:28.078",
        "org": "example-io",
        "user": "john1987",
      }
  - Name: GitHub - Org Moderator removed
    ExpectedResult: false
    Log:
      {
        "_document_id": "Ab123",
        "action": "organization_moderators.remove_user",
        "actor": "sarah78",
        "actor_location": { "country_code": "US" },
        "at_sign_timestamp": "2022-12-11 05:17:28.078",
        "created_at": "2022-12-11 05:17:28.078",
        "org": "example-io",
        "user": "john1987",
      }

Detection logic

Condition

action eq "organization_moderators.add_user"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actioneq
  • organization_moderators.add_user

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
action
actor
actor_locationactor_location.country_code
org
repo
user