LoFP LoFP / installing a documented ci, chat, or ticketing integration that uses github webhooks. confirm the payload url and subscribed events with the repository owners.

Techniques

Sample rules

GitHub Webhook Created or Configuration Changed

Description

Detects creation or configuration change of a GitHub webhook. Attackers can add a hook to copy push, pull request, and workflow payloads (including secrets that land in those events) to an external URL.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  data_stream.dataset == "github.audit"
    and (github.actor_is_bot is not null and github.actor_is_bot == false)
    and event.action in ("hook.create", "hook.config_changed")
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.hook_id,
    github.name,
    github.actor_is_bot