Panther high experimental python

GitHub Branch Protection Disabled

Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.

View Source

Detection Logic

def rule(event):

    return event.get("action") == "protected_branch.destroy"


def title(event):
    return (
        f"A branch protection was removed from the "
        f"repository [{event.get('repo', '<UNKNOWN_REPO>')}] "
        f"by [{event.get('actor', '<UNKNOWN_ACTOR>')}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...