GitHub Secret Scanning Push Protection Bypassed or Disabled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GitHub Secret Scanning Push Protection Bypassed or Disabled

Detects bypass of GitHub secret scanning push protection, approval of a bypass request, or disabling push protection at enterprise, organization, or repository scope. This is separate from turning secret scanning off. Bypass means a detected secret was allowed into the repository — the pattern used after tj-actions and similar CI secret-dump attacks.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: SaaS
Platform: GitHub
Use Case: Threat Detection
Tactic: Defense Evasion
Data Source: Github
Data Source: GitHub Audit Logs
Rule Type: ESQL
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GitHub Secret Scanning Push Protection Bypassed or Disabled

secret_scanning_push_protection.bypass fires when a user pushes a detected secret anyway. secret_scanning_push_protection_request.approve is a reviewer allowing that push. business_secret_scanning_push_protection.disable, org.secret_scanning_push_protection_disable, and repository_secret_scanning_push_protection.disable turn the control off at enterprise, organization, and repository scope respectively (the *_new_repos_disable actions turn it off for newly created repositories). This is separate from disabling secret scanning itself, which is covered by the GitHub Secret Scanning Disabled rule.

Possible investigation steps

Identify user.name, github.repo, event.action, and github.secret_type, and confirm whether the actor is expected to bypass or administer this control.
Review github.actor_ip and github.user_agent to validate the source of the change, and pivot on github.hashed_token / github.programmatic_access_type to determine whether it was performed via the UI or a token.
For a bypass or approved bypass: inspect the commit that landed, rotate the secret type reported in github.secret_type, and check workflow logs for printed credentials.
For a disable: re-enable push protection and review commits pushed during the window it was off.
Correlate with other control changes in the same window (secret scanning disabled, bypass-list additions, new owners, PAT grants) that may indicate broader tampering.

False positive analysis

Security team testing push protection with a known dummy value during an approved exercise.
A noisy custom pattern that maintainers temporarily disable. Confirm no live secret was pushed and that the control is re-enabled afterward.

Response and remediation

Re-enable push protection at the affected scope. Rotate any secret that was bypassed.
Restrict who can bypass or disable the control, and review the push-protection bypass list.
Review Actions secrets and PATs created in the same window, and confirm the acting account is not compromised.

Rule query

edit

from logs-github.audit-* metadata _id, _index, _version
| where
  data_stream.dataset == "github.audit"
    and event.action in (
      "secret_scanning_push_protection.bypass",
      "secret_scanning_push_protection_request.approve",
      "business_secret_scanning_push_protection.disable",
      "business_secret_scanning_push_protection.disabled_for_new_repos",
      "org.secret_scanning_push_protection_disable",
      "org.secret_scanning_push_protection_new_repos_disable",
      "repository_secret_scanning_push_protection.disable"
    )
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.secret_type

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/

« GitHub SAML SSO Disabled GitHub SSH Certificate Authority or Requirement Modified »