selection item added.

rules/cloud/github/dependabot_alerts_disabled.yml

@@ -23,6 +23,7 @@ detection:
             - 'dependabot_alerts_new_repos.disable'
             - 'dependabot_security_updates.disable'
             - 'dependabot_security_updates_new_repos.disable'
+            - 'repository_vulnerability_alerts.disable'
     condition: selection
 fields:
     - 'action'

rules/cloud/github/github_high_risk_configuration_change.yml

@@ -0,0 +1,36 @@
+title: Github High Risk Configuration Change
+id: 8622c92d-c00e-463c-b09d-fd06166f6794
+status: experimental
+description: Detects when a user disables a critical security feature for an organization.
+author: Muhammad Faisal
+date: 2023/01/29
+references:
+    - https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
+    - https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
+tags:
+    - attack.t1556
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'org.disable_oauth_app_restrictions'
+            - 'org.disable_two_factor_requirement'
+            - 'repo.advanced_security_disabled'
+            - 'org.advanced_security_policy_selected_member_disabled'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+    - 'transport_protocol_name'
+    - 'repository'
+    - 'repo'
+    - 'repository_public'
+    - '@timestamp'
+falsepositives:
+     - Approved administrator/owner activities.
+level: critical

rules/cloud/github/github_new_org_member_alert.yml

@@ -0,0 +1,32 @@
+title: Github New Org Member Alert
+id: 3908d64a-3c06-4091-b503-b3a94424533b
+status: experimental
+description: Detects when a new member is added or invited to the org.
+author: Muhammad Faisal
+date: 2023/01/29
+references:
+    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
+tags:
+    - attack.t1136.003
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        action:
+            - 'org.add_member'
+            - 'org.invite_member'
+    condition: selection
+fields:
+    - 'action'
+    - 'actor'
+    - 'org'
+    - 'actor_location.country_code'
+    - 'transport_protocol_name'
+    - 'repository'
+    - 'repo'
+    - 'repository_public'
+    - '@timestamp'
+falsepositives:
+     - Organization approved new members
+level: informational