Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that's not in the allowlist. This behavior may indicate unauthorized access to information.
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.
This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.
This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.
Page 34 of 73