Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.
This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.
This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.
This rule detects when changes are made to a GitHub organization's fine-grained Personal Access Token (PAT) approval policy. Specifically, it triggers on events related to enabling or disabling the auto-approval of PAT requests, or enabling or disabling the forbidding of auto-approval for PAT requests. Such changes could indicate an attempt to weaken security controls around PATs, potentially allowing for easier creation of tokens that could be used for unauthorized access.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a GitHub repository's visibility is changed from 'internal' to 'public'. This change can expose sensitive code or data, potentially leading to data exfiltration or unauthorized access. The rule specifically looks for 'repo.access' events where the 'previous_visibility' was 'internal' and 'public_repo' is now 'true'.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.
This rule detects when a GitHub organization initiates an outgoing transfer to another enterprise account. This activity is suspicious because an adversary might attempt to transfer a GitHub organization to an enterprise account they control to steal data, intellectual property, or maintain persistence. The rule specifically looks for the `org.transfer_outgoing` event type in GitHub audit logs.
Detects when branch protection rules are disabled for a GitHub repository. This action can indicate an adversary attempting to bypass security controls to push malicious code or make unauthorized changes to a codebase.
This rule detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration. This includes disabling SAML, updating SAML provider settings, disabling OIDC, and managing credential authorizations (deauthorize, grant, revoke). Such modifications can indicate an attempt to bypass or alter security controls, potentially for unauthorized access or defense evasion.
This rule detects when vulnerability alerts are disabled for GitHub Dependabot. Disabling these alerts can prevent developers from being notified about security vulnerabilities in their dependencies, potentially leading to unpatched systems and increased risk. This action could be an attempt by an attacker to impair defenses and hide their activities or to prevent the organization from identifying and remediating vulnerabilities.
Detects when a GitHub repository is archived or deleted. This activity could indicate malicious intent, such as an attacker attempting to destroy evidence or disrupt development, or it could be a legitimate administrative action. Monitoring these events is crucial for maintaining code integrity and operational continuity.
Detects when a GitHub organization is removed from an enterprise. This action can lead to a loss of access to repositories, projects, and other organizational resources, potentially disrupting operations or indicating malicious activity aimed at disrupting the software development lifecycle.
This rule detects when GitHub secret scanning components are disabled or bypassed at the enterprise, organization, or repository level. This includes disabling secret scanning entirely, disabling it for new repositories, or bypassing push protection for custom patterns or generic secrets. Such actions can significantly reduce the security posture by allowing sensitive information to be committed to repositories without detection.
Page 135 of 142