GitHub PR review enforcement removed for main

github-telemetry

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detects when a Github pull request review enforcement level is deactivated for a protected branch.

Strategy

Monitor events related to changes in branch protection rules in GitHub repositories. Specifically, look for actions indicating that required pull request (PR) review enforcement has been disabled for a protected branch.

Triage and Response

  1. Identify whether {{@github.actor}} should be disabling the PR review enforcement for {{@name}} branch in the {{@github.repository}} repository.
  2. If the activity is suspicious:
    • Block the user in GitHub to prevent further access.
    • Begin your organization’s incident response process and investigate.