Threat video1:00
GitHub Actions Injection Hits 61 Repos: Detection & IOCs
Attackers injected Bash command substitution payloads through GitHub Actions issue and PR text. 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for GitHub Actions Injection Hits 61 Repos: Detection & IOCs →
Chapters
- 0:00The hook83 command injection attacks on GitHub.
- 0:04The story61 repositories targeted.
- 0:11Attack pathAccording to Radware, attackers posted malicious content to 61 repositories.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise2 indicators to hunt: 1 IP and 1 URL.
- 0:37MITRE ATT&CK techniques11 ATT&CK techniques, from resource development to exfiltration.
- 0:43Remediation13 remediation steps are listed, 5 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0083 command injection attacks on GitHub.
0:0561 repositories targeted.
0:07Hidden commands triggered instant execution.
0:11According to Radware, attackers posted malicious content to 61 repositories.
0:17Hidden commands triggered workflows.
0:19Runners dumped environment variables.
0:22But theft and compromise weren't confirmed.
0:27No threat actor is attributed. Confidence: low.
0:322 indicators to hunt: 1 IP and 1 URL.
0:3811 ATT&CK techniques, from resource development to exfiltration.
0:4313 remediation steps are listed, 5 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.