GitHub SSH key added by suspicious IP

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a SSH key has been added from a suspicious IP.

Strategy

This rule monitors GitHub audit logs for when a SSH key has been added from a suspicious IP. A phishing campaign reported by Github’s security team indicated that attackers may try to add a SSH key once they have gained unauthorized access to an account to maintain access. Using Datadog threat intelligence the signals raised will have originated from IP addresses deemed to be suspicious.

Note: By default GitHub does not display the source IP address for events in your organization’s audit log. See this post for further information.

Triage and response

  1. Determine if the behavior is unusual for the user:
    • Is the @actor_location.country_code or @http.useragent different?
    • If IP addresses are available, is the @network.client.ip or @network.client.geoip.as.domain different than usual?
    • Speak with the user to verify if they added the SSH key.
  2. If the activity is suspicious:
    • Block the user in GitHub to prevent further access.
    • Begin your organization’s incident response process and investigate.