Panther medium experimental python

GitHub Workflow Permissions Modified

Detects when the default workflow permissions for the GITHUB_TOKEN are modified at the organization level. GitHub Actions workflows use GITHUB_TOKEN for authentication, and changing these permissions can either expand or restrict what workflows can do by default. Unauthorized modifications could allow attackers to escalate privileges in CI/CD pipelines, potentially leading to supply chain compromise through malicious workflow modifications, unauthorized code deployments, or exfiltration of secrets. This is particularly concerning as it affects all repositories in the organization unless overridden at the repository level.

View Source

Detection Logic

def rule(event):

    return (
        event.get("action") == "org.set_default_workflow_permissions"
        and event.get("operation_type") == "modify"
    )


def title(event):
    return (
        f"Workflow permission settings for GITHUB_TOKENs have been changed"
        f" for your organization [{event.get('org')}]"
        f" by user [{event.get('actor')}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...