GitHub unknown user cloned private repository

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when a unknown actor clones a Github repository.

This rule monitors GitHub audit logs for when a repository clone occurs but the actor field is null.

Determine if the clone action was taken by IP address associated with the activity is from a known corporate device.
If the clone action cannot be attributed to an internal user, then begin your organization’s incident response process and investigate.