Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
42
7
2
1
1
Contributors
39
9
3
2
1
Categories
19
15
14
14
13
Platforms
40
14
10
5
2
Products / Services
33
17
6
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Page 3 of 3