Detection rules › Panther
GitHub Team Modified
Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1195 Supply Chain Compromise |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body yaml
AnalysisType: rule
Filename: github_team_modified.py
RuleID: "GitHub.Team.Modified"
DisplayName: "GitHub Team Modified"
Enabled: true
LogTypes:
- GitHub.Audit
Tags:
- GitHub
- Initial Access:Supply Chain Compromise
Reports:
MITRE ATT&CK:
- TA0001:T1195
Reference: https://docs.github.com/en/organizations/organizing-members-into-teams
Severity: Info
Description: Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control.
Tests:
- Name: GitHub - Team Deleted
ExpectedResult: true
Log:
{
"actor": "cat",
"action": "team.destroy",
"created_at": 1621305118553,
"data": { "team": "my-org/my-team" },
"org": "my-org",
"p_log_type": "GitHub.Audit",
"repo": "my-org/my-repo",
}
- Name: GitHub - Team Created
ExpectedResult: true
Log:
{
"actor": "cat",
"action": "team.create",
"created_at": 1621305118553,
"data": { "team": "my-org/my-team" },
"org": "my-org",
"p_log_type": "GitHub.Audit",
"repo": "my-org/my-repo",
}
- Name: GitHub - Team Add repository
ExpectedResult: true
Log:
{
"actor": "cat",
"action": "team.add_repository",
"created_at": 1621305118553,
"data": { "team": "my-org/my-team" },
"org": "my-org",
"p_log_type": "GitHub.Audit",
"repo": "my-org/my-repo",
}
Detection logic
Condition
action starts_with "team"
action eq "team.add_member" or action eq "team.add_repository" or action eq "team.change_parent_team" or action eq "team.create" or action eq "team.destroy" or action eq "team.remove_member" or action eq "team.remove_repository"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.