github_user_access_key_created.yml

AnalysisType: rule
Filename: github_user_access_key_created.py
RuleID: GitHub.User.AccessKeyCreated
DisplayName: GitHub User Access Key Created
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Persistence:Valid Accounts
Reports:
  MITRE ATTACK:
    - TA0003:T1078
Severity: Info
Description: Detects when a GitHub user access key is created.
Tests:
  -
    Name: GitHub - User Access Key Created
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "public_key.create",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo"
      }
  -
    Name: GitHub - User Access Key Deleted
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "public_key.delete",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo"
      }