GitHub Branch Protection Policy Override

AnalysisType: rule
Filename: github_branch_policy_override.py
RuleID: "GitHub.Branch.PolicyOverride"
DisplayName: "GitHub Branch Protection Policy Override"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: High
Description: Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.
Runbook: Verify that the GitHub admin performed this activity and validate its use.
Reference: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
Tests:
  - Name: GitHub - Branch Protection Policy Override
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "protected_branch.policy_override",
        "branch": "refs/heads/main",
        "created_at": 1621305118553,
        "p_log_type": "GitHub.Audit",
        "org": "my-org",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Protected Branch Name Updated
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "protected_branch.update_name",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }


# ------ paired body: github_branch_policy_override.py ------

def rule(event):

    return event.get("action") == "protected_branch.policy_override"


def title(event):
    branch = event.get("branch", "<UNKNOWN_BRANCH>")
    return (
        f"A branch protection requirement in the repository"
        f" [{event.get('repo', '<UNKNOWN_REPO>')}]"
        f" was overridden by user [{event.udm('actor_user')}]"
        f" on branch [{branch}]"
    )