LoFP LoFP / network changes, office ip rotations, or vpn egress updates performed by org owners. confirm the entry value and that enforcement was not enabled unexpectedly.

Techniques

Sample rules

GitHub IP Allow List Modified

Description

Detects changes to a GitHub organization IP allow list: creating, updating, or deleting allow-list entries, or enabling/disabling allow-list enforcement (including enforcement for installed GitHub Apps, the IdP-provided web allow list, and user-level enforcement). Adversaries with org-owner access may add or modify their own address, then enable enforcement, or weaken enforcement and remove legitimate entries to lock out administrators.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "ip_allow_list_entry.create",
      "ip_allow_list_entry.update",
      "ip_allow_list_entry.destroy",
      "ip_allow_list.enable",
      "ip_allow_list.disable",
      "ip_allow_list.enable_for_installed_apps",
      "ip_allow_list.disable_for_installed_apps",
      "ip_allow_list.enable_idp_ip_allowlist_for_web",
      "ip_allow_list.disable_idp_ip_allowlist_for_web",
      "ip_allow_list.enable_user_level_enforcement",
      "ip_allow_list.disable_user_level_enforcement"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.name