GitHub Branch Protection Disabled

AnalysisType: rule
Filename: github_branch_protection_disabled.py
RuleID: "GitHub.Branch.ProtectionDisabled"
DisplayName: "GitHub Branch Protection Disabled"
Enabled: true
LogTypes:
  - GitHub.Audit
Tags:
  - GitHub
  - Initial Access:Supply Chain Compromise
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
Severity: High
Description: Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.
Runbook: Verify that branch protection should be disabled on the repository and re-enable as necessary.
Reference: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
Tests:
  - Name: GitHub - Branch Protection Disabled
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "protected_branch.destroy",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }
  - Name: GitHub - Protected Branch Name Updated
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "protected_branch.update_name",
        "created_at": 1621305118553,
        "org": "my-org",
        "p_log_type": "GitHub.Audit",
        "repo": "my-org/my-repo",
      }


# ------ paired body: github_branch_protection_disabled.py ------

def rule(event):

    return event.get("action") == "protected_branch.destroy"


def title(event):
    return (
        f"A branch protection was removed from the "
        f"repository [{event.get('repo', '<UNKNOWN_REPO>')}] "
        f"by [{event.get('actor', '<UNKNOWN_ACTOR>')}]"
    )