Secret Exposed and not Quarantined

Description

The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS. When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.

Query

Detection:
    - Group:
        - ID: SecretNotQuarantined
          RuleID: AWS.CloudTrail.IAMCompromisedKeyQuarantine
          Absence: true
        - ID: SecretFound
          RuleID: GitHub.Secret.Scanning.Alert.Created
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Excludes

  • AWS.CloudTrail.IAMCompromisedKeyQuarantine — excluded, not a dependency
Raw source Secret Exposed and not Quarantined · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Secret.Exposed.and.not.Quarantined.Group"
DisplayName: "Secret Exposed and not Quarantined"
Enabled: false
Tags:
    - 'Unsecured Credentials: Credentials in Files'
    - Configuration Required
Severity: High
Reports:
    MITRE ATT&CK:
        - TA0006:T1552.001
Description: The rule detects when a GitHub Secret Scan detects an exposed secret, which is not followed by the expected quarantine operation in AWS.  When you make a repository public, or push changes to a public repository, GitHub always scans the code for secrets that match partner patterns. Public packages on the npm registry are also scanned. If secret scanning detects a potential secret, we notify the service provider who issued the secret. The service provider validates the string and then decides whether they should revoke the secret, issue a new secret, or contact you directly. Their action will depend on the associated risks to you or them.
Reference: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning
Detection:
    - Group:
        - ID: SecretNotQuarantined
          RuleID: AWS.CloudTrail.IAMCompromisedKeyQuarantine
          Absence: true
        - ID: SecretFound
          RuleID: GitHub.Secret.Scanning.Alert.Created
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 10
      LookbackWindowMinutes: 1800
Tests:
    - Name: Secret Found and Quarantined
      ExpectedResult: false
      RuleOutputs:
        - ID: SecretFound
          Matches: # The match field is required when using timestamps, so I use a dummy field name
            foo:
              bar: [30]
        - ID: SecretNotQuarantined
          Matches:
            foo:
              bar: [0]
    - Name: Secret Found and Not Quarantined
      ExpectedResult: true
      RuleOutputs:
        - ID: SecretFound
          Matches:
            foo:
              bar: [0]

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.