GitHub Secret Scanning Alert for a Publicly Leaked Secret

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GitHub Secret Scanning Alert for a Publicly Leaked Secret

Detects GitHub secret scanning creating an alert for a secret that it has determined is publicly leaked ("github.publicly_leaked == true"). Unlike a generic secret-scanning finding, a publicly leaked secret means GitHub observed the credential exposed outside the repository’s access boundary (for example in a public repository, gist, or other public location), so it should be treated as a confirmed credential compromise requiring immediate rotation rather than a low-signal scanner event. Gating on the public-leak flag also removes most of the noise from dummy strings and test fixtures, which are typically confined to private repositories and are not flagged as publicly leaked.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning

Tags:

Domain: Cloud
Domain: SaaS
Platform: GitHub
Use Case: Threat Detection
Tactic: Credential Access
Data Source: GitHub Audit Logs
Service: GitHub Code Scanning
Rule Type: ESQL
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GitHub Secret Scanning Alert for a Publicly Leaked Secret

secret_scanning_alert.create with github.publicly_leaked == true means GitHub determined the matched secret is exposed in a public location, not just committed to the repository. Treat the credential as compromised and rotate it immediately.

Possible investigation steps

Identify the exposed credential type from github.secret_type / github.secret_type_display_name and the affected github.repo and github.org.
Review github.multi_repo; if true, the same secret was detected across multiple repositories, widening the blast radius.
Identify the committer via user.name (vs the github service actor) and corroborate with github.actor_ip and github.user_agent.
Determine the source and scope of the public exposure and whether the secret grants access to production systems.

False positive analysis

Example or dummy keys intentionally published to a public repository can be flagged as publicly leaked. Scope these by repository or github.secret_type.

Response and remediation

Revoke and rotate the exposed credential immediately, then invalidate any sessions or tokens derived from it.
Remove the secret from git history if required by policy and audit for any use of the credential prior to rotation.

Rule query

edit

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "secret_scanning_alert.create"
    and github.publicly_leaked == true
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.secret_type,
    github.secret_type_display_name,
    github.publicly_leaked,
    github.multi_repo

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Unsecured Credentials
- ID: T1552
- Reference URL: https://attack.mitre.org/techniques/T1552/
Sub-technique:
- Name: Credentials In Files
- ID: T1552.001
- Reference URL: https://attack.mitre.org/techniques/T1552/001/

« GitHub SSO Recovery Codes Activity GitHub Advanced Security Disabled »