Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
42
7
2
1
1
Contributors
39
9
3
2
1
Categories
19
15
14
14
13
Platforms
40
14
10
5
2
Products / Services
33
17
6
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
This rule detects potential CI/CD security compromises in GitHub by monitoring for modifications to workflow permissions that grant 'write-all' access, access to sensitive workflow secrets via 'pull_request_target' from forked repositories, and the registration of new self-hosted runners. These actions are common indicators of supply chain attacks aimed at poisoning pipeline execution or exfiltrating build secrets.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
Detects unauthorized modifications to GitHub Actions workflow configuration files (.github/workflows/*.yml) that explicitly enable automated publishing triggers (push to main branch). The rule looks for specific content patterns in the workflow file indicating a push-to-main trigger and monitors for suspicious or known bad commit hashes associated with such changes.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects the use of AI assistant command-line interfaces (such as Claude, GitHub Copilot, or Gemini) to execute git checkout commands with specific commit hashes or references like FETCH_HEAD. This behavior may indicate an attempt to use automated AI tooling to stage or interact with repository code, which could be part of an automated exfiltration or unauthorized code modification attempt.
Detects Git checkout operations executed by AI coding agent processes that specify a full 40-character commit hash or use 'FETCH_HEAD'. This behavior is indicative of potential supply chain attacks, specifically the 'Plugin4Shell' vulnerability, where malicious actors attempt to force the agent to checkout arbitrary, potentially malicious, repository references.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects a 'git checkout' command targeting a specific commit SHA that is not followed within five minutes by a 'git rev-parse HEAD' integrity check. This behavior, known as 'Plugin4Shell', involves an attacker replacing a pinned commit with a malicious branch of the same name, potentially leading to unauthorized code execution if verification steps are absent.
Page 2 of 3