GitHub - A payment method was removed

Back


Id	6bb50582-caac-4a9b-9afb-3fee766ebbf7
Rulename	GitHub - A payment method was removed
Description	Detect activities when a payment method was removed. This query runs every day and its severity is Medium.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Kind	Scheduled
Query frequency	1d
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - A payment method was removed.yaml
Version	1.0.1
Arm template	6bb50582-caac-4a9b-9afb-3fee766ebbf7.json

KQL

GitHubAuditData
| where Action == "payment_method.remove"
| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

YAML

name: GitHub - A payment method was removed
query: |
  GitHubAuditData
  | where Action == "payment_method.remove"
  | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])  
queryFrequency: 1d
triggerOperator: gt
requiredDataConnectors: []
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Actor
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitHub/Analytic Rules/GitHub - A payment method was removed.yaml
description: |
    'Detect activities when a payment method was removed. This query runs every day and its severity is Medium.'
version: 1.0.1
id: 6bb50582-caac-4a9b-9afb-3fee766ebbf7
kind: Scheduled
relevantTechniques:
- T1078
severity: Medium
tactics:
- InitialAccess
queryPeriod: 7d

ARM