detection.wiki

Detection rules › Panther

DEPRECATED - GitHub Web Hook Modified

Status
Deprecated
Severity
informational
Log types
GitHub.Audit
Tags
GitHub, Exfiltration:Automated Exfiltration, Deprecated
Reference
https://docs.github.com/en/webhooks/about-webhooks
Source
github.com/panther-labs/panther-analysis

Deprecated. See GitHub.Webhook.Modified instead.

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1020 Automated Exfiltration

Rule body yaml

AnalysisType: rule
Filename: github_repo_hook_modified.py
RuleID: "GitHub.Repo.HookModified"
DisplayName: "DEPRECATED - GitHub Web Hook Modified"
Status: Deprecated
Enabled: false
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Exfiltration:Automated Exfiltration
  - Deprecated
Reports:
  MITRE ATT&CK:
    - TA0010:T1020
Reference: https://docs.github.com/en/webhooks/about-webhooks
Severity: Info
Description: Deprecated. See GitHub.Webhook.Modified instead.
Tests:
  - Name: GitHub - Webhook Created
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "hook.create",
        "data":
          {
            "hook_id": 111222333444555,
            "events": ["fork", "public", "pull_request", "push", "repository"],
          },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repository": "my-org/my-repo",
      }
  - Name: GitHub - Webhook Deleted
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "hook.destroy",
        "data":
          {
            "hook_id": 111222333444555,
            "events": ["fork", "public", "pull_request", "push", "repository"],
          },
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repository": "my-org/my-repo",
      }
  - Name: GitHub - Non Webhook Event
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "org.invite_member",
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repository": "my-org/my-repo",
      }

Detection logic

Condition

action starts_with "hook."

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionstarts_with
  • hook.

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
repo