Panther informational experimental python

GitHub Workflow Dispatched by GitHub Actions Bot

Detects when a GitHub App server-to-server token (GITHUB_TOKEN) triggers a workflow manually through the workflow_dispatch event, creating a new workflow run. This activity may indicate that a possibly previously exfiltrated GITHUB_TOKEN was subsequently used to authenticate to the GitHub REST API to trigger a workflow manually. This technique has been observed as the last step in the attack chain of the Nx/S1ngularity supply chain attack.

View Source

Detection Logic

from panther_github_helpers import github_alert_context


def rule(event):

    return all(
        [
            event.get("programmatic_access_type") == "GitHub App server-to-server token",
            event.get("event") == "workflow_dispatch",
            event.get("actor") == "github-actions[bot]",
            event.get("action") == "workflows.created_workflow_run",
        ]
    )


def title(event):
    repo = event.get("repo", default="<NO_REPO>")
    workflow_name = event.get("name", default="<NO_WORKFLOW_NAME>")
    user = event.get("actor")
    return (
        f"Bot [{user}] manually triggered a "
        f"workflow dispatch for [{workflow_name}] "
        f"in [{repo}]"
    )


def alert_context(event):
    context = github_alert_context(event)
    context["workflow_name"] = event.get("name", "<NO_WORKFLOW_NAME>")
    context["workflow_id"] = event.get("workflow_id")
    context["workflow_run_id"] = event.get("workflow_run_id")
    context["head_branch"] = event.get("head_branch")
    context["head_sha"] = event.get("head_sha")
    context["programmatic_access_type"] = event.get("programmatic_access_type")
    context["token_id"] = event.get("token_id")
    context["workflow_run_link"] = (
        f"https://github.com/{context.get('repo')}/actions/"
        f"runs/{event.get('workflow_run_id', '<NO_RUN_ID>')}"
    )
    return context

Field Validations

Loading…

Comments (0)

Loading comments...