The article explains how to threat hunt for suspicious activity in GitHub audit logs, focusing on compromised accounts, stolen tokens, OAuth abuse, and API enumeration that can lead to source code exfiltration. It highlights specific log quirks, hunting queries, and indicators that help detect attackers pivoting from GitHub into CI/CD pipelines, cloud environments, and secrets stores. #GitHub #Datadog #OAuth #GitHubAuditLogs #GitTrees #secret-scanning
Keypoints
- Attackers are targeting GitHub accounts and tokens to steal source code and pivot into connected cloud and CI/CD environments.
- The article focuses on hunting suspicious activity using GitHub audit logs and Datadog Security Research guidance.
- Common initial access vectors include leaked tokens, device code phishing, malicious OAuth apps, infostealer-compromised laptops, and compromised user accounts.
- GitHub logging quirks can complicate investigations, including missing identity data, missing source IPs on failures, and confusing token permission fields.
- Hunting queries are provided for sign-ins from unrecognized devices, OAuth authorization, secret discovery, private repo enumeration, and repository content access.
- Indicators of compromise include unusual ASN or geolocation, bursts of API requests, access to many distinct repositories, and use of recursive Git Trees or private repo routes.
- Datadog recommends ingesting GitHub audit logs into Cloud SIEM and using detections plus token-level correlation via hashed_token.
MITRE Techniques
- [T1078 ] Valid Accounts – Attackers use stolen GitHub credentials or tokens to access the organization (‘gaining the first access, typically through compromised secrets’; ‘a valid credential such as a personal access token, an OAuth access token, or a compromised user account’).
- [T1566 ] Phishing – Device code phishing is used to trick victims into authorizing attacker-generated codes (‘the victim sees a real GitHub URL and a real prompt, enters a code the attacker generated, and authorizes a token’).
- [T1110 ] Brute Force – Credential stuffing is mentioned as a way attackers obtain valid credentials (‘credentials through phishing, credential stuffing, secrets leaked in public repos, or malicious OAuth apps’).
- [T1528 ] Steal Application Access Token – Attackers abuse OAuth access tokens and user-to-server tokens for unauthorized access (‘personal access token, an OAuth access token’; ‘user has granted a user-to-server token’).
- [T1087 ] Account Discovery – Attackers enumerate org resources, members, teams, and repositories to map the environment (‘list every accessible repository and page through members, teams, and repository metadata’).
- [T1595 ] Active Scanning – Attackers probe GitHub resources and paths to discover exposed data (‘a single API request can expose sensitive information about the organization’; ‘walk a private repo’s file tree’).
- [T1083 ] File and Directory Discovery – Attackers browse repository trees and contents to locate valuable files (‘walk a private repo’s file tree via the Git Trees API … or Contents API’).
- [T1213 ] Data from Information Repositories – Attackers collect source code and secret-scanning alert data from GitHub (‘steal source code’; ‘pulling secret-scanning alert findings’).
- [T1552 ] Unsecured Credentials – Attackers locate secrets stored in GitHub before stealing them (‘secrets stored in GitHub … offer one of the most direct paths to escalate into other systems’; ‘listing which repos, orgs, or environments have secrets configured’).
- [T1041 ] Exfiltration Over C2 Channel – Source code exfiltration occurs after access is gained (‘used stolen access for source code exfiltration’).
Indicators of Compromise
- [API routes ] secrets discovery and repo enumeration – /organizations/:organization_id/secret-scanning/alerts, /repositories/:repository_id/actions/secrets, and /organizations/:organization_id/repos
- [API routes ] private repository file access – /repositories/:repository_id/git/trees, /repositories/:repository_id/git/trees/*, and /repositories/:repository_id/contents*
- [Event types ] suspicious sign-in and authorization – user.sign_in_from_unrecognized_device_and_location, oauth_authorization.create
- [Fields ] token and access correlation – hashed_token, programmatic_access_type, token_scopes
- [Fields ] identity and location context – external_identity_nameid, source IP, country code, user agent, ASN
- [Query parameters / fields ] repo paging and private access clues – page, type=private, recursive=1
- [Status codes ] successful suspicious API activity – 200-299, 2*, and other non-error reads
Read more: https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/