Query: alert when Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules
Matching passage: Sigma rule: Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules. Logsource: github / audit. Rule: title: Github Push Protection Disabled id: ccd55945-badd-4bae-936b-823a735d37dd status: test description: Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - business_secret_scanning_custom_pattern_push_protection.disabled - business_secret_scanning_push_protection.disable - business_secret_scanning_push_protection.disabled_for_new_repos - org.secret_scanning_custom_pattern_push_protection_disabled - org.secret_scanning_push_protection_disable - org.secret_scanning_push_protection_new_repos_disable - repository_secret_scanning_custom_pattern_push_protection.disabled condition: selection falsepositives: - Allowed administrative activities. level: high
Near-miss passage: Sigma rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a. Logsource: windows / process_creation. Rule: title: WMI Persistence - Script Event Consumer id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e status: test description: 'Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://redcanary.com/blog/threat-detection/child-processes/ - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2022-10-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: Image: C:\WINDOWS\system32\wbem\scrcons.exe ParentImage: C:\Windows\System32\svchost.exe condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium