GitHub Repository Created or Added Outside Normal Pattern

Siddhant Mishra@Siddhant

•updated yesterday•0•0•1

Detects repository creation or addition to an organisation. Attackers use new repositories as staging ground for exfiltrated data, as hosting for second-stage payloads under a trusted domain, or as a place to park stolen source. Pair with the creating identity: a repository created by an account that has never created one before is the interesting case. Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870). Integration guide: https://bloo.io/docs/hypercloud/github-connector BQL (Bloo Query Language): stream=github where sourcename='GITHUB' and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED') | groupby target, repositoryid, newrepositoryadded, organisationid