Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when third-party application access restrictions are disabled for a GitHub organization. This action can increase the attack surface by allowing unauthorized or malicious OAuth applications to access organization resources.
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.
This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.
This rule detects when a GitHub enterprise is deleted. This action can lead to significant data loss and disruption of services, indicating a critical security event or a malicious act. The rule correlates the user ID and the GitHub enterprise name over a 30-minute window to identify such deletions.
This rule detects when changes are made to a GitHub organization's fine-grained Personal Access Token (PAT) approval policy. Specifically, it triggers on events related to enabling or disabling the auto-approval of PAT requests, or enabling or disabling the forbidding of auto-approval for PAT requests. Such changes could indicate an attempt to weaken security controls around PATs, potentially allowing for easier creation of tokens that could be used for unauthorized access.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a GitHub repository's visibility is changed from 'internal' to 'public'. This change can expose sensitive code or data, potentially leading to data exfiltration or unauthorized access. The rule specifically looks for 'repo.access' events where the 'previous_visibility' was 'internal' and 'public_repo' is now 'true'.
This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.
This rule detects when a GitHub organization initiates an outgoing transfer to another enterprise account. This activity is suspicious because an adversary might attempt to transfer a GitHub organization to an enterprise account they control to steal data, intellectual property, or maintain persistence. The rule specifically looks for the `org.transfer_outgoing` event type in GitHub audit logs.
Detects when branch protection rules are disabled for a GitHub repository. This action can indicate an adversary attempting to bypass security controls to push malicious code or make unauthorized changes to a codebase.
This rule detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration. This includes disabling SAML, updating SAML provider settings, disabling OIDC, and managing credential authorizations (deauthorize, grant, revoke). Such modifications can indicate an attempt to bypass or alter security controls, potentially for unauthorized access or defense evasion.
This rule detects when vulnerability alerts are disabled for GitHub Dependabot. Disabling these alerts can prevent developers from being notified about security vulnerabilities in their dependencies, potentially leading to unpatched systems and increased risk. This action could be an attempt by an attacker to impair defenses and hide their activities or to prevent the organization from identifying and remediating vulnerabilities.
Detects when a GitHub repository is archived or deleted. This activity could indicate malicious intent, such as an attacker attempting to destroy evidence or disrupt development, or it could be a legitimate administrative action. Monitoring these events is crucial for maintaining code integrity and operational continuity.
Detects when a GitHub organization is removed from an enterprise. This action can lead to a loss of access to repositories, projects, and other organizational resources, potentially disrupting operations or indicating malicious activity aimed at disrupting the software development lifecycle.
This rule detects when GitHub secret scanning components are disabled or bypassed at the enterprise, organization, or repository level. This includes disabling secret scanning entirely, disabling it for new repositories, or bypassing push protection for custom patterns or generic secrets. Such actions can significantly reduce the security posture by allowing sensitive information to be committed to repositories without detection.
This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization. This could indicate an attacker attempting to weaken security controls to facilitate unauthorized access or maintain persistence.
Page 133 of 143