IR-07 / TRIGGERS
Activate for code, identity, delivery, or artifact compromise
Source and governance
- Malicious or unauthorized commits
- Compromised maintainer/developer accounts
- Branch protection or ruleset changes
- Release, tag, signature, or history tampering
Automation and credentials
- GitHub Actions or workflow modification
- CI/CD secret exposure
- PAT, deploy/SSH key, GitHub App, OIDC, cloud, registry, or signing-key compromise
- Persistence through workflows, bots, hooks, apps, runners, or scheduled jobs
Supply chain
- Dependency or lockfile manipulation
- Package publishing compromise
- Artifact, cache, image, provenance, or release compromise
- Compromised packages, actions, plugins, tools, submodules, or dependencies
01 / PRESERVE
Capture evidence before cleanup
Stop active harm when necessary, but preserve the investigation record before deleting workflows, refs, packages, artifacts, integrations, or accounts whenever safe.
- Export organization, enterprise, repository, identity, package, cloud, registry, and provider audit logs.
- Preserve Git objects and refs, suspicious commits and diffs, reflogs where available, tags, releases, signatures, branches, pull requests, reviews, and protection/ruleset history.
- Save workflow definitions, run logs, job summaries, artifacts, caches metadata, runner state, environments, deployment records, OIDC claims, and provenance attestations.
- Record actors, identities, token types, IP addresses, user agents, timestamps, correlation/request IDs, affected repositories, environments, and downstream systems.
- Hash exports and record collector, source, UTC collection time, acquisition method, storage location, access, and transfers.
Do not rely on the suspect repository as the only evidence copy. Preserve into controlled storage and avoid executing untrusted code, workflows, hooks, package scripts, or build artifacts during collection.
02 / SCOPE
Audit every execution and persistence surface
| Surface | Review | Downstream question |
|---|---|---|
| Git and reviews | History, force updates, branches, tags, signatures, authorship, reviews, bypasses, generated files, submodules | Which clones, forks, mirrors, releases, or builds consumed affected refs? |
| Identity and access | Maintainers, collaborators, teams, PATs, SSH/deploy keys, apps, OAuth grants, sessions, MFA, SSO, role and ruleset changes | What else could the identity or credential reach? |
| Actions and delivery | Workflow/reusable-workflow changes, permissions, triggers, expressions, runners, environments, OIDC, secrets, logs, artifacts and caches | Which cloud, registry, deployment, or production actions completed? |
| Dependencies and packages | Manifests, lockfiles, registries, maintainers, install scripts, checksums, advisories, package versions and publish events | Which consumers installed or redistributed affected versions? |
| Persistence and automation | Webhooks, bots, apps, hooks, runners, scheduled jobs, automation accounts, mirrors, package jobs and branch bypasses | Can the adversary regain access or reintroduce content? |
| Artifacts and releases | Build inputs, hashes, signatures, provenance, containers, binaries, release assets, caches and deployment records | Can every delivered artifact be reproduced from trusted source? |
03 / CONTAIN & ERADICATE
Close identity and execution paths deliberately
Contain active access
- Restrict compromised accounts and revoke affected sessions, PATs, keys, app tokens, OIDC trust, cloud credentials, registry tokens, and signing material.
- Pause malicious workflows, releases, package publication, deployments, runners, webhooks, apps, bots, hooks, mirrors, or scheduled jobs.
- Protect known-clean administrators and evidence channels.
- Notify affected package, artifact, deployment, mirror, and consumer owners with approved facts.
Remove persistence
- Restore least-privilege access, rulesets, branch protection, required reviews, environments, and workflow permissions.
- Remove unauthorized integrations and rebuild suspect hosted/self-hosted runner state from trusted images.
- Audit dependencies and reinstall reviewed, integrity-verified, strongly pinned versions.
- Search discovered indicators across all in-scope repositories, organizations, registries, clouds, and delivery systems.
Secret-rotation gate
Rotate according to demonstrated or plausible exposure, not mechanically. Determine which secret values were accessible to the compromised identity, workflow, runner, artifact, log, or build. Revoke old material, update every consumer, test replacements, and retain proof without recording secret values.
04 / TRUSTED RECOVERY
Prove the recovery point and rebuild
- Determine the last trusted source point using independent audit evidence, signed objects where meaningful, reviewed diffs, known contributor activity, and external release/build records.
- Compare code, workflows, dependencies, lockfiles, packages, tags, releases, settings, rulesets, identities, and integrations to the trusted baseline.
- Run code scanning, secret scanning across current content and relevant history, dependency review, malware analysis, and incident-specific hunts. Rotate exposed secrets before treating alert closure as remediation.
- Rebuild packages, containers, releases, and deployment artifacts in a clean environment from trusted source and dependencies; do not reuse suspect caches.
- Verify hashes, signatures, provenance, SBOMs, test results, workflow permissions, environment approvals, and business behavior.
Recovery gate
Resume development and delivery only when the attack path is closed, compromised credentials are revoked, persistence is absent, trusted builds and scans are reviewed, affected downstream consumers are addressed, rollback is ready, and accountable security and service owners approve residual risk.
05 / POST-RECOVERY
Monitor the whole delivery path
- Monitor audit logs, identity activity, API calls, Git operations, workflows, runners, deployments, packages, registries, artifact downloads, ruleset changes, and secret/code scanning alerts.
- Track reappearance of malicious commits, dependencies, actions, infrastructure, identities, signatures, tokens, or release versions.
- Confirm downstream consumers have rebuilt, upgraded, revoked, or otherwise remediated affected artifacts and credentials.
- Document root cause, timeline, evidence gaps, impacted consumers, notifications, containment impact, residual risk, corrective owners, and verification dates.
- Exercise repository-compromise recovery, credential rotation, clean builds, and package/consumer notification paths.