GitHub PR review enforcement removed for main

github-telemetry

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects when a Github pull request review enforcement level is deactivated for a protected branch.

Strategy

Monitor events related to changes in branch protection rules in GitHub repositories. Specifically, look for actions indicating that required pull request (PR) review enforcement has been disabled for a protected branch.

Triage and Response

  1. Identify whether {{@github.actor}} should be disabling the PR review enforcement for {{@name}} branch in the {{@github.repository}} repository.
  2. If the activity is suspicious:
    • Block the user in GitHub to prevent further access.
    • Begin your organization’s incident response process and investigate.