Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
411 detections
Filters
Last updated
All Time
Detection languages
181
74
63
61
11
Contributors
113
62
55
52
32
Categories
140
133
102
96
49
Platforms
309
74
43
15
15
Products / Services
10,665
9,773
6,704
4,421
3,749
411
MITRE Techniques
126
125
81
72
64
CVEs
5
1
1
1
1
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects Python processes attempting to read process memory (/proc/*/mem) or using a specific shell pipeline to scrape GitHub Actions Runner memory for masked secrets, as observed in the Mini Shai-Hulud supply chain attack.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.
Detects when a user disables a critical security feature for an organization.
Detects if the secret scanning feature is disabled for an enterprise or repository.
Detects when a user bypasses the push protection on a secret detected by secret scanning.
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when changes are made to the SSH certificate configuration of the organization.
Detects the creation of a GitHub repository named `tpcp-docs`. This specific repository name is utilized as a fallback exfiltration channel by the TeamPCP threat actor. During the Trivy supply chain attack, the malware abused stolen GitHub tokens to create this public repository on the victim's account to host stolen data as release assets when the primary exfiltration method failed.
Detects a high volume of 'git push --force' events specifically targeting tags from a single user or to a single repository within a short timeframe.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
Detects a 'git push --force' event in GitHub audit logs. A force push overwrites the remote repository's history with the local history, which is a potentially destructive action.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
This technique was notably used in the supply chain attack against the 'aquasecurity/trivy-action' repository, where attackers force-pushed malicious versions to existing version tags.
Detects when a repository's branch protection, specifically the 'allow force pushes' enforcement level, is updated or disabled. This rule explicitly excludes events originating from automation scripts to reduce false positives.
Detects action of Repo branch protection being disabled by the means of a force push. This would mean no PR or review process is needed and an actor (Insider or attacker) could push arbitrary code.
Page 12 of 20