GitHub Enterprise

Reported Context (3)

changes and pushes made with stolen credentials. The catch is that it’s in public preview for GitHub Enterprise only. The related push rules may also not work on public repos, which leaves out the open source GhostAction Adds GitHub Phishing as GitHub Rolls Out Security Features
by an email change or 2FA recovery code use, aimed at slowing account takeovers. Separately, GitHub Enterprise rolled out self-service credential revocation, letting enterprise owners revoke tokens, SSH keys, Podcast Covers GitHub Account Protections, Malicious npm Packages and FBI TeamPCP Notice
be monitored as these search API calls are not logged, despite contradictory claims in current GitHub Enterprise audit logs documentation. Wiz is currently working with GitHub support to resolve this discrepancy. How Attackers Use GitHub PATs to Move from Repositories into Cloud Environments

People (3)

Threat Actors (1)

MITRE ATT&CK (10)

Vendors (6)

Products (9)

Tools (1)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.