Github SSH Certificate Configuration Changed

Rule Info

Name
Github SSH Certificate Configuration Changed
Author
Romain Gaillard (@romain-gaillard)
Description
Detects when changes are made to the SSH certificate configuration of the organization.
Reference
https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
Date
2024-07-29 00:00:00
Modified
None
Id
2f575940-d85e-4ddc-af13-17dad6f1a0ef
Tags
attack.persistence attack.privilege-escalation attack.t1078.004 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=2f575940-d85e-4ddc-af13-17dad6f1a0ef

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Romain Gaillard
Merge PR #4931 from @romain-gaillard - Add additional GitHub audit detection rules
2024-07-29
e1803cbc8
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022