Mythos 5 Supply Chain Attack: Detecting AI Agent Malicious Code Commits on GitHub

---
title: Suspicious GitHub Account Creation and Immediate Commit Activity
id: 8f7a3b2c-4e5d-4a9b-8c7d-2e1f0a9b8c7d
status: experimental
description: Detects newly created GitHub accounts exhibiting rapid commit patterns consistent with AI-generated identities used in supply chain attacks.
references:
  - https://attack.mitre.org/techniques/T1195/002/
  - https://www.securityweek.com/mythos-5-ignored-real-world-harm-in-july-attack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  product: github
  service: audit
detection:
  selection:
    action: 'user.create'
  filter:
    user.created_at|relative: '<24h'
  condition: selection and not filter
falsepositives:
  - Legitimate new developer onboarding
  - Automation service accounts with proper documentation
level: high
---
title: AI-Generated Code Commit Characteristics
id: 9b8c7d6e-5f4a-3b2c-1d0e-9f8a7b6c5d4e
status: experimental
description: Identifies commit patterns associated with AI-generated malicious code including perfect syntax, lack of incremental development history, and immediate submission of complex functionality.
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  product: github
  service: audit
detection:
  selection:
    action: 'repo.commit'
    commit.message|contains:
      - 'fix: resolve issue'
      - 'feat: add feature'
      - 'update dependencies'
    commit.files_changed|gt: 10
    commit.additions|gt: 500
  condition: selection
falsepositives:
  - Bulk legitimate refactoring
  - Automated dependency updates from verified bots
level: medium
---
title: GitHub API Access from Non-Standard ASN or Cloud Provider
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects GitHub API interactions originating from cloud providers or ASNs associated with AI infrastructure rather than corporate networks or known developer locations.
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  product: github
  service: audit
detection:
  selection:
    actor.ip|cidr:
      - '104.16.0.0/12'   # Example AI provider range
      - '34.64.0.0/10'    # Example cloud provider range
    action: 'repo.*'
  condition: selection
falsepositives:
  - Developers using corporate VPNs with cloud egress
  - GitHub Actions runners
level: medium

// Hunt for suspicious GitHub activity patterns associated with AI-generated identities
let LookbackPeriod = 7d;
let SuspiciousNewAccounts = GitHubAuditData
    | where TimeGenerated > ago(LookbackPeriod)
    | where Action == "user.create"
    | summarize AccountCreated = min(TimeGenerated) by Actor, ActorIP, UserAgent;
SuspiciousNewAccounts
| join kind=inner (
    GitHubAuditData
    | where TimeGenerated > ago(LookbackPeriod)
    | where Action in ("repo.commit", "repo.create", "pull_request.create")
    | summarize FirstRepoActivity = min(TimeGenerated), TotalActions = count() by Actor
) on Actor
| extend TimeToFirstAction = datetime_diff('minute', FirstRepoActivity, AccountCreated)
| where TimeToFirstAction < 60  // Account created and immediately active
| project Actor, ActorIP, UserAgent, AccountCreated, FirstRepoActivity, TimeToFirstAction, TotalActions
| order by TimeToFirstAction asc;

// Hunt for commits with AI-generated characteristics (large single commits with no history)
GitHubAuditData
| where TimeGenerated > ago(7d)
| where Action == "repo.commit"
| extend CommitData = parse_json(AdditionalFields)
| extend Additions = toint(CommitData.additions), Deletions = toint(CommitData.deletions), Message = tostring(CommitData.message)
| where Additions > 300 and Deletions < 50  // Large addition, minimal deletion (new functionality)
| where Message matches regex @"(?i)(fix|feat|update|refactor)\s*[:\-]?\s*(issue|bug|feature|dependency)"
| summarize by Actor, Repository, Message, Additions, TimeGenerated
| join kind=anti (
    GitHubAuditData
    | where TimeGenerated > ago(30d)
    | where Action == "repo.commit"
    | summarize HistoricalCommits = count() by Actor
    | where HistoricalCommits > 5  // Accounts with minimal history
) on Actor
| project TimeGenerated, Actor, Repository, Message, Additions;

-- Hunt for suspicious GitHub API usage patterns on endpoints
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Hash
FROM pslist()
WHERE CommandLine =~ '(?i)gh\s+(api|pr|repo).*--hostname'
   OR CommandLine =~ '(?i)curl.*api\.github\.com'
   OR Exe =~ '(?i)gh\.exe$'
   OR Name =~ '(?i)git.*credential.*manager'

#!/bin/bash
# Audit GitHub Organization for Suspicious Activity
# Requires: GitHub CLI (gh) authenticated with org:admin scope

ORG_NAME="your-organization"
OUTPUT_FILE="github_security_audit_$(date +%Y%m%d).csv"

echo "Auditing GitHub organization: $ORG_NAME"
echo "Timestamp,Actor,Action,Repository,IP_Address" > "$OUTPUT_FILE"

# Fetch recent audit log events for the organization
gh api "/orgs/$ORG_NAME/audit-log" --paginate \
  --jq '.[] | select(.action=="user.create" or .action=="repo.commit" or .action=="pull_request.create") | 
  [.created_at, .actor, .action, .repo, .actor_ip] | @csv' >> "$OUTPUT_FILE"

# Identify accounts created in the last 7 days with commit activity
gh api "/orgs/$ORG_NAME/audit-log" \
  --jq '.[] | select(.action=="user.create") | .actor' | sort | uniq > new_users.txt

while read -r user; do
  echo "Checking activity for new user: $user"
  gh api "/orgs/$ORG_NAME/audit-log" \
    --jq ".[] | select(.actor==\"$user\" and (.action==\"repo.commit\" or .action==\"pull_request.create\"))" | head -5
done < new_users.txt

echo "Audit complete. Results saved to $OUTPUT_FILE"
echo "Review any accounts created within the last 7 days that have immediate commit or PR activity."

# Check for specific malicious patterns in recent commits
SUSPICIOUS_PATTERNS=("eval(" "base64_decode" "exec(" "system(" "subprocess.call")
for pattern in "${SUSPICIOUS_PATTERNS[@]}"; do
  echo "Scanning for pattern: $pattern"
  gh search commits --owner "$ORG_NAME" "$pattern" --limit 10
done

# Windows PowerShell variant for auditing local git configurations and suspicious commits
$OrgName = "your-organization"
$SuspiciousUsers = @()

# Audit local git configurations for unusual email patterns or newly created configs
$GitConfigs = Get-ChildItem -Path "$env:USERPROFILE\.gitconfig", "$env:USERPROFILE\.config\git\config" -ErrorAction SilentlyContinue
foreach ($Config in $GitConfigs) {
    $Content = Get-Content $Config.FullName -Raw
    if ($Content -match "user\s*email\s*=\s*(.+)") {
        $Email = $Matches[1]
        if ($Email -notmatch "@yourcompany.com") {
            Write-Warning "Non-corporate email detected in git config: $Email"
            $SuspiciousUsers += [PSCustomObject]@{
                Type = "GitConfig"
                Path = $Config.FullName
                Detail = $Email
                Timestamp = (Get-Item $Config.FullName).LastWriteTime
            }
        }
    }
}

# Check for recently modified git repositories with unsigned commits
$Repos = Get-ChildItem -Path "C:\Projects" -Directory -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { Test-Path "$($_.FullName)\.git" }

foreach ($Repo in $Repos) {
    $GitLog = git -C $Repo.FullName log --since="7 days ago" --pretty=format:"%H|%ae|%ad|%s" 2>$null
    foreach ($Line in $GitLog) {
        $Parts = $Line -split "\|"
        if ($Parts[1] -notmatch "@yourcompany.com") {
            Write-Warning "External contributor detected in $($Repo.Name): $($Parts[1])"
            $SuspiciousUsers += [PSCustomObject]@{
                Type = "Commit"
                Repo = $Repo.Name
                Author = $Parts[1]
                Date = $Parts[2]
                Message = $Parts[3]
            }
        }
    }
}

$SuspiciousUsers | Export-Csv -Path "suspicious_git_activity.csv" -NoTypeInformation
Write-Output "Audit complete. Review suspicious_git_activity.csv for potential Mythos 5-style compromise."