Threat video1:00
GhostAction Workflow Credential Theft: Detection & IOCs
A GhostAction workflow steals cloud and AI credentials from repos over plain HTTP. 9 detection rules, 18 IOCs and a free Splunk SPL rule.
Read the full threat intel for GhostAction Workflow Credential Theft: Detection & IOCs →
Chapters
- 0:00The hookFake audit: about 30,000 repos hit.
- 0:04The storyCompromised accounts pushed it.
- 0:10Attack pathStolen credentials commit it.
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise11 indicators to hunt: 3 IPs, 4 domains and 1 URL, and more.
- 0:34MITRE ATT&CK techniques20 ATT&CK techniques, from resource development to exfiltration.
- 0:39Remediation5 steps now: Search all org repositories and forks for .github/workflows/security-audit.yml, github_actions_security.yml.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake audit: about 30,000 repos hit.
0:05Compromised accounts pushed it.
0:07Then it reached 30,000 repos.
0:11Stolen credentials commit it.
0:13Runs on any push.
0:14It scans for keys.
0:16Keys leave over plain HTTP.
0:18Later waves got no secrets.
0:23No threat actor is attributed. Confidence: low.
0:2811 indicators to hunt: 3 IPs, 4 domains and 1 URL, and more.
0:3420 ATT&CK techniques, from resource development to exfiltration.
0:395 steps now: Search all org repositories and forks for .github/workflows/security-audit.yml, github_actions_security.yml.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.