Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Posts tagged: #supply-chain

← Back to all posts
GitHub supply chain attack investigation: a walkthrough
A fictional GitHub supply chain attack investigated end to end: stolen PAT, 38 repos cloned, AWS keys printed by a workflow, branch protection removed.
supply-chainincident-responsehow-to
Branch protection disabled? Auditing GitHub rulesets
Investigate GitHub branch protection or ruleset tampering: protected_branch.destroy, ruleset changes, admin overrides, environments, and what landed meanwhile.
org-securitysupply-chainaudit-log
Self-hosted runner security: GitHub Actions forensics
Rogue or compromised GitHub self-hosted runners: the audit log events to check, host evidence in _diag, and how to scope and rebuild after an incident.
github-actionssupply-chainincident-response
GitHub Actions secrets leak: investigating exfiltration
How GitHub Actions secrets leak despite *** masking: poisoned workflows, new branches, encoded output and third-party actions. The evidence to collect and read.
github-actionssupply-chainincident-response
GitHub organization compromised? Incident response guide
What to do when your GitHub organization is compromised: preserve the audit log, contain tokens and workflows, scope with Git events, then pivot to the cloud.
incident-responseaudit-logsupply-chain

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.