Elastic medium stable kql

GitHub Actions Workflow Modification Blocked

Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.

View Source

Detection Logic

from logs-github.audit-* metadata _id, _index, _version
| where
    data_stream.dataset == "github.audit" and
    event.action == "protected_branch.rejected_ref_update" and
    github.category == "protected_branch" and
    github.reasons.code == "workflow_updates" and
    match(github.reasons.message::STRING, "refusing to allow a GitHub App to create or update workflow")
| keep *

False Positives

⚠ Legitimate CI/CD automation that requires workflow file modifications may trigger this alert if not properly configured with the necessary permissions. Review the workflow configuration and ensure the GITHUB_TOKEN or PAT has the required 'workflows' permission if the modification is intentional.

Field Validations

Loading…

Comments (0)

Loading comments...