LoFP / example or dummy tokens that are themselves committed to a public repository can still be flagged as publicly leaked. tune by repository, pattern name (`github.secret_type`), or known test org when such keys are expected.

Techniques

• T1552

Sample rules

GitHub Secret Scanning Alert for a Publicly Leaked Secret

• source: elastic
• technicques:
  • T1552

Description

Detects GitHub secret scanning creating an alert for a secret that it has determined is publicly leaked (“github.publicly_leaked == true”). Unlike a generic secret-scanning finding, a publicly leaked secret means GitHub observed the credential exposed outside the repository’s access boundary (for example in a public repository, gist, or other public location), so it should be treated as a confirmed credential compromise requiring immediate rotation rather than a low-signal scanner event. Gating on the public-leak flag also removes most of the noise from dummy strings and test fixtures, which are typically confined to private repositories and are not flagged as publicly leaked.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "secret_scanning_alert.create"
    and github.publicly_leaked == true
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.secret_type,
    github.secret_type_display_name,
    github.publicly_leaked,
    github.multi_repo