Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization. This could indicate an attacker attempting to weaken security controls to facilitate unauthorized access or maintain persistence.
This rule detects when a user is unblocked from accessing repositories within a GitHub organization. This event could indicate a change in access policy, a remediation action after a block, or potentially an unauthorized modification of user access rights.
This rule identifies when a user downloads, views, or copies a potentially malicious file from Google Drive. The detection is triggered if the file has a public visibility setting ('people_with_link' or 'public_on_the_web') and its name matches a common executable or script file extension (e.g., .dll, .exe, .scr, .jar, .pif, .app, .dmg, .pkg, .elf, .so, .bin, .deb, .rpm, .sh, .hta, .lnk). This aims to detect user interaction with suspicious files that could lead to execution of malicious code.
Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.
Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.
Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when branch protection rules are disabled for a GitHub repository.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization.
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.
Detects when a user is removed from a group in Microsoft Teams. This could indicate an attempt to remove a user's access to sensitive team resources or a legitimate administrative action.
Detects when a GitHub application is installed within an organization. An untrusted application can be installed and granted permissions to access data within a GitHub organization.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when a GitHub audit log stream is destroyed. An adversary may attempt to destroy audit logs to erase their tracks.
Detects when a GitHub enterprise is deleted.
Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when an invitation to join a GitHub enterprise or organization is sent to a non-company email address. This rule can be customized to alert you when a GitHub invitation is sent to an unexpected domain i.e. not one of your company's domains used for email.
Page 136 of 142