Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
Detect users who are newly created and then immediately assigned administrator level roles
Adding users to roles is expected but if it occurs outside of PIM, validation should occur
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
Detects when third-party application access restrictions are disabled for a GitHub organization. This action can increase the attack surface by allowing unauthorized or malicious OAuth applications to access organization resources.
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.
This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.
This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.
This rule detects when changes are made to a GitHub organization's fine-grained Personal Access Token (PAT) approval policy. Specifically, it triggers on events related to enabling or disabling the auto-approval of PAT requests, or enabling or disabling the forbidding of auto-approval for PAT requests. Such changes could indicate an attempt to weaken security controls around PATs, potentially allowing for easier creation of tokens that could be used for unauthorized access.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a GitHub repository's visibility is changed from 'internal' to 'public'. This change can expose sensitive code or data, potentially leading to data exfiltration or unauthorized access. The rule specifically looks for 'repo.access' events where the 'previous_visibility' was 'internal' and 'public_repo' is now 'true'.
This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.
This rule detects when a GitHub organization initiates an outgoing transfer to another enterprise account. This activity is suspicious because an adversary might attempt to transfer a GitHub organization to an enterprise account they control to steal data, intellectual property, or maintain persistence. The rule specifically looks for the `org.transfer_outgoing` event type in GitHub audit logs.
Detects when branch protection rules are disabled for a GitHub repository. This action can indicate an adversary attempting to bypass security controls to push malicious code or make unauthorized changes to a codebase.
This rule detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration. This includes disabling SAML, updating SAML provider settings, disabling OIDC, and managing credential authorizations (deauthorize, grant, revoke). Such modifications can indicate an attempt to bypass or alter security controls, potentially for unauthorized access or defense evasion.
This rule detects when vulnerability alerts are disabled for GitHub Dependabot. Disabling these alerts can prevent developers from being notified about security vulnerabilities in their dependencies, potentially leading to unpatched systems and increased risk. This action could be an attempt by an attacker to impair defenses and hide their activities or to prevent the organization from identifying and remediating vulnerabilities.
Detects when a GitHub repository is archived or deleted. This activity could indicate malicious intent, such as an attacker attempting to destroy evidence or disrupt development, or it could be a legitimate administrative action. Monitoring these events is crucial for maintaining code integrity and operational continuity.
Page 133 of 144