developers adding a key for a new workstation, or administrators adding an approved deploy key for ci/cd or repository automation. confirm the key, source ip, affected account or repository, and expected access level.

t1098
github
elastic

Techniques

T1098

Sample rules

GitHub SSH or Deploy Key Added

source: elastic
technicques:
- T1098

Description

Identifies the addition of an SSH public key to a GitHub user account or a deploy key to a repository. These keys grant Git access over SSH, so an adversary can add one to maintain persistent repository access after the original password, session, or token is revoked. Note that a user-level public_key.create action may not appear in a non-EMU enterprise audit stream, where it is retained only in the per-user security log.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "public_key.create"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent