detection.wiki

Detection rules › Panther

GitHub User Access Key Created

Severity
informational
Log types
GitHub.Audit
Tags
GitHub, Persistence:Valid Accounts
Reference
https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
Source
github.com/panther-labs/panther-analysis

Detects when a GitHub user access key is created.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1078 Valid Accounts

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: rule
Filename: github_user_access_key_created.py
RuleID: "GitHub.User.AccessKeyCreated"
DisplayName: "GitHub User Access Key Created"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0003:T1078
Reference: https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent
Severity: Info
Description: Detects when a GitHub user access key is created.
Tests:
  - Name: GitHub - User Access Key Created
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "public_key.create",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - User Access Key Deleted
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "public_key.delete",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }

Detection logic

Condition

action eq "public_key.create"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actioneq
  • public_key.create

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
actor_user