Query: Sigma rule for Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Matching passage: Sigma rule: Detects delete action in the Github audit logs for codespaces, environment, project and repo.. Logsource: github / audit. Rule: title: Github Delete Action Invoked id: 16a71777-0b2e-4db7-9888-9d59cb75200b status: test description: Detects delete action in the Github audit logs for codespaces, environment, project and repo. author: Muhammad Faisal (@faisalusuf) date: 2023-01-19 modified: 2026-03-09 references: - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces tags: - attack.impact - attack.collection - attack.t1213.003 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - codespaces.destroy - environment.delete - project.delete - repo.destroy condition: selection falsepositives: - Validate the deletion activity is permitted. The "actor" field need to be validated. level: medium
Near-miss passage: Sigma rule: Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Microsoft Dialer id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1 status: test description: 'Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it''s usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys" ' references: - https://tria.ge/240301-rk34sagf5x/behavioral2 - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html author: CertainlyP date: 2024-04-26 tags: - attack.execution - attack.command-and-control - attack.t1071.001 logsource: category: network_connection product: windows detection: selection: Image|endswith: :\Windows\System32\dialer.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives. level: high