Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
12
11
6
2
2
Contributors
10
10
6
2
2
Categories
21
15
8
8
6
Platforms
29
2
2
1
1
Products / Services
19
7
5
5
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects repositories being downloaded. Source code is intellectual property and
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
Detects unauthenticated guest users abusing the Salesforce Experience Cloud Aura endpoint (/s/sfsites/aura) to perform high-volume metadata and schema enumeration. This activity typically involves tools like AuraInspector to harvest CRM data by repeatedly invoking Aura actions such as describeSObjects, getSObjectMetadata, ObjectInfoController, or RecordUiController.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
This rule detects Git repository modification events (such as pushes, branch creation, or reference creation) where the reference name matches a hexadecimal string (often indicative of a specific commit hash being pushed as a branch or tag) and the host is not github.com. This may indicate suspicious repository activity or interaction with non-standard or unauthorized code repositories.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
This rule detects a high volume of requests to download repository archives from a GitLab instance. Specifically, it triggers when 10 or more HTTP requests containing '/repository/archive' in the URI and 'gitlab.' in the HTTP host header are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate data by bulk downloading repository contents.
This rule detects a high volume of HTTP requests to GitHub's archive endpoint for repository cloning, specifically looking for 10 or more requests within 60 seconds from a single source IP. This behavior could indicate an attempt to collect data from multiple GitHub repositories, potentially for reconnaissance or data exfiltration purposes. The rule targets HTTP traffic where the host is 'github.com' and the URI contains '/archive/'.
Detects delete action in the Github audit logs for codespaces, environment, project and repo.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when a full data export is initiated in Bitbucket. This event indicates that a complete backup or export of all data within the Bitbucket instance has been triggered. This could be a legitimate administrative action but also a precursor to data exfiltration by an attacker who has gained administrative access to the Bitbucket server.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Page 1 of 2