Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a Github pull request review enforcement level is deactivated for a protected branch.

Strategy

Monitor events related to changes in branch protection rules in GitHub repositories. Specifically, look for actions indicating that required pull request (PR) review enforcement has been disabled for a protected branch.

Triage and Response

1. Identify whether {{@github.actor}} should be disabling the PR review enforcement for {{@name}} branch in the {{@github.repository}} repository.
2. If the activity is suspicious:
   • Block the user in GitHub to prevent further access.
   • Begin your organization’s incident response process and investigate.