Detection rules › Panther

Panther rules: secret

Rule	Severity
Secret Exposed and not Quarantined	`high`

Secret Exposed and not Quarantined

Severity: high
Time window: 30h
Tags: Unsecured Credentials: Credentials in Files, Configuration Required
Reference: docs.github.com
Source: github.com/panther-labs/panther-analysis

The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS. When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files

Rule specification

AnalysisType: correlation_rule
RuleID: "Secret.Exposed.and.not.Quarantined.Group"
DisplayName: "Secret Exposed and not Quarantined"
Enabled: false
Tags:
    - 'Unsecured Credentials: Credentials in Files'
    - Configuration Required
Severity: High
Reports:
    MITRE ATT&CK:
        - TA0006:T1552.001
Description: The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS.  When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.
Reference: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
Detection:
    - Group:
        - ID: SecretNotQuarantined
          RuleID: AWS.CloudTrail.IAMCompromisedKeyQuarantine
          Absence: true
        - ID: SecretFound
          RuleID: GitHub.Secret.Scanning.Alert.Created
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800

Stages and Predicates

Fires when the steps below all occur within 30h. Each step needs one match unless a higher minimum is shown.

Stage 1: `step SecretNotQuarantined` (negated)

References detection AWS Compromised IAM Key Quarantine.

Stage 2: `step SecretFound`

References detection GitHub Secret Scanning Alert Created.