detection.wiki

Detection rules › Panther

Secret Exposed and not Quarantined

Severity
high
Time window
1h
Tags
Unsecured Credentials: Credentials in Files, Configuration Required
Reference
https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
Source
github.com/panther-labs/panther-analysis

The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS. When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552.001 Unsecured Credentials: Credentials In Files

Rule body yaml

AnalysisType: correlation_rule
RuleID: "Secret.Exposed.and.not.Quarantined"
DisplayName: "Secret Exposed and not Quarantined"
Enabled: false
Tags:
    - 'Unsecured Credentials: Credentials in Files'
    - Configuration Required
Severity: High
Reports:
    MITRE ATT&CK:
        - TA0006:T1552.001
Description: The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS.  When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.
Reference: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
Detection:
    - Sequence:
        - ID: SecretFound
          RuleID: GitHub.Secret.Scanning.Alert.Created
        - ID: SecretNotQuarantined
          RuleID: AWS.CloudTrail.IAMCompromisedKeyQuarantine
          Absence: true
      Transitions:
        - ID: SecretFound TO SecretNotQuarantined
          From: SecretFound
          To: SecretNotQuarantined
          WithinTimeFrameMinutes: 60
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 2160
Tests:
    - Name: Secret Found and Quarantined
      ExpectedResult: false
      RuleOutputs:
        - ID: SecretFound
          Matches: # The match field is required when using timestamps, so I use a dummy field name
            foo:
              bar: [0]
        - ID: SecretNotQuarantined
          Matches:
            foo:
              bar: [30]
    - Name: Secret Found and Not Quarantined
      ExpectedResult: true
      RuleOutputs:
        - ID: SecretFound
          Matches:
            foo:
              bar: [0]

Detection logic

Stage 1: step SecretFound ordered before $SecretNotQuarantined

References detection GitHub.Secret.Scanning.Alert.Created.

Stage 2: step SecretNotQuarantined (negated) ordered after $SecretFound

References detection AWS.CloudTrail.IAMCompromisedKeyQuarantine.