Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
12
11
6
2
2
Contributors
10
10
6
2
2
Categories
21
15
8
8
6
Platforms
29
2
2
1
1
Products / Services
19
7
5
5
5
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
2
IDS Protocols
2
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
This rule detects attempts by an unauthorized user to trigger a full data export from Bitbucket. This activity could indicate an adversary attempting to collect sensitive information, such as source code or credentials, from the code repository.
Detects when full data export is attempted.
Detects when full data export is attempted an unauthorized user.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Looks for accounts that uploaded multiple code repositories to external web domain.
Detects when a user grants access to a GitHub Personal Access Token (PAT) and subsequently clones a high number of non-public GitHub repositories. This behavior can indicate an adversary attempting to steal the contents of multiple GitHub repositories using an automated script or offensive tool after gaining access to a PAT.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Page 2 of 2