planned ca rotation. create the replacement ca before deleting the old one, and do not disable the certificate requirement except during a documented outage.

Techniques

Sample rules

GitHub SSH Certificate Authority or Requirement Modified

source: elastic
technicques:
- T1556
- T1562

Description

Detects creation or deletion of a GitHub SSH certificate authority (CA), or disabling the requirement that members use SSH certificates, for an organization or enterprise. A CA lets an org issue short-lived SSH certificates and optionally require them in place of personal SSH keys, centralizing and time-bounding Git access. Destroying the CA or dropping the requirement makes ordinary unmanaged SSH keys acceptable again. Following an account takeover, an adversary may make these changes to authenticate with keys the organization does not manage and evade certificate-based access control, making this a high-impact change to Git access controls.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action in (
      "ssh_certificate_authority.create",
      "ssh_certificate_authority.destroy",
      "ssh_certificate_requirement.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.business