Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
31
14
4
2
2
Contributors
15
7
6
5
4
Categories
39
20
10
9
7
Platforms
24
18
6
5
4
Products / Services
25
6
5
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
3
1
IDS Protocols
3
1
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects evidence of PSNATCH or BASHNATCH tools exfiltrating data to GitHub. The rule identifies suspicious file operations related to an 'SmartUploader' tracking file in standard user directories (AppData, .local/share), monitors for SmartUploader process execution, and flags network connections to api.github.com from processes identified as SmartUploader, bash, or PowerShell.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
GitHub Public Repository Created
Cortex XDR
Detects the creation of a new public repository within GitHub. This activity, while often legitimate, poses a potential data exposure risk by making code or sensitive assets publicly accessible. The rule identifies events where repository visibility is explicitly set to public for governance and security review.
Page 1 of 3