GitHub anomalous number of repositories cloned by user

github-telemetry

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a GitHub member has cloned an anomalous number of repositories.

Strategy

This rule monitors GitHub audit logs for when a GitHub member has cloned an anomalous number of repositories. An attacker with unauthorized access or insider threat may try to clone repositories to their system in an effort to collect data for exfiltration or gaining contextual awareness of the environment.

Note: During the onboarding of new staff it is likely that there will be a spike in cloning activity.

Triage and response

  1. Determine if the behavior is unusual for the user:
    • Is the @actor_location.country_code or @http.useragent different?
    • If IP addresses are available, is the @network.client.ip or @network.client.geoip.as.domain different than usual?
  2. If the activity is suspicious:
    • Block the user in GitHub to prevent further access.
    • Begin your organization’s incident response process and investigate.