Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects when a user disables critical security features within a GitHub organization or repository. This includes disabling advanced security features, OAuth app access restrictions, or two-factor authentication requirements. Such actions can significantly weaken the security posture of a GitHub environment, potentially leading to unauthorized access or compromise.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
This rule detects the creation of an API token within the Okta environment. API tokens can be used for programmatic access to Okta resources, and their creation, especially if unauthorized or unexpected, could indicate an attempt to establish persistence or gain unauthorized access to the identity provider.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
Detects when an Okta policy is modified or deleted, which could indicate an attempt to alter security controls or bypass existing policies. This activity should be monitored closely as it can precede unauthorized access or other malicious actions.
Detects when a GitHub Pages site of a repository is made public. This action, while potentially part of a legitimate publishing process, could also indicate an adversary attempting to expose sensitive information or code publicly. Monitoring this activity helps identify potential unauthorized data exposure.
This rule detects when an API token is revoked within the Okta environment. API tokens are used for authentication and authorization to access Okta APIs. Revoking a token can be a normal administrative action, but it can also indicate an attempt to disable a compromised token or an adversary attempting to disrupt legitimate access.
This rule detects attempts to access Okta administrative functions when the request is routed through a proxy. This could indicate an adversary attempting to bypass security controls or obscure their origin when performing administrative actions within Okta.
Detects when an Okta ThreatInsight security threat is detected. This indicates that Okta has identified suspicious activity, potentially from a malicious IP address, attempting to access an organization's Okta tenant.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
This rule detects when a repository within Bitbucket is configured to be exempt from secret scanning. This action could indicate an attempt to bypass security controls and hide sensitive information or malicious code within the repository without detection.
Detects when a user bypasses the push protection on a secret detected by secret scanning in GitHub. This indicates an attempt to commit code containing sensitive information despite automated safeguards.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.
Detects changes to the Bitbucket audit log configuration. This could indicate an adversary attempting to disable or modify logging to evade detection.
Detects when the global SSH access configuration is changed within Bitbucket. This could indicate an attempt to enable or modify SSH access for malicious purposes, potentially for lateral movement or persistence.
This rule detects when an Okta Policy Rule is either modified or deleted. Monitoring changes to policy rules is crucial as unauthorized modifications or deletions could indicate an attempt to bypass security controls, alter access permissions, or disrupt normal operations within the Okta environment. Such actions could lead to unauthorized access, privilege escalation, or impact the availability of services.
Page 124 of 142