Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
411 detections
Filters
Last updated
All Time
Detection languages
181
74
63
61
11
Contributors
113
62
55
52
32
Categories
140
133
102
96
49
Platforms
309
74
43
15
15
Products / Services
10,665
9,758
6,692
4,421
3,749
411
MITRE Techniques
126
125
81
72
64
CVEs
5
1
1
1
1
This rule detects when vulnerability alerts are disabled for GitHub Dependabot. Disabling these alerts can prevent developers from being notified about security vulnerabilities in their dependencies, potentially leading to unpatched systems and increased risk. This action could be an attempt by an attacker to impair defenses and hide their activities or to prevent the organization from identifying and remediating vulnerabilities.
Detects when a GitHub repository is archived or deleted. This activity could indicate malicious intent, such as an attacker attempting to destroy evidence or disrupt development, or it could be a legitimate administrative action. Monitoring these events is crucial for maintaining code integrity and operational continuity.
Detects when a GitHub organization is removed from an enterprise. This action can lead to a loss of access to repositories, projects, and other organizational resources, potentially disrupting operations or indicating malicious activity aimed at disrupting the software development lifecycle.
This rule detects when GitHub secret scanning components are disabled or bypassed at the enterprise, organization, or repository level. This includes disabling secret scanning entirely, disabling it for new repositories, or bypassing push protection for custom patterns or generic secrets. Such actions can significantly reduce the security posture by allowing sensitive information to be committed to repositories without detection.
This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization. This could indicate an attacker attempting to weaken security controls to facilitate unauthorized access or maintain persistence.
This rule detects when a user is unblocked from accessing repositories within a GitHub organization. This event could indicate a change in access policy, a remediation action after a block, or potentially an unauthorized modification of user access rights.
Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.
Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.
Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when branch protection rules are disabled for a GitHub repository.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization.
Detects when a GitHub application is installed within an organization. An untrusted application can be installed and granted permissions to access data within a GitHub organization.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when a GitHub audit log stream is destroyed. An adversary may attempt to destroy audit logs to erase their tracks.
Detects when a GitHub enterprise is deleted.
Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Page 19 of 20