Detections

Explore public detection logic contributed by the community across SIEM and rule languages.

411 detections

Detects when an invitation to join a GitHub enterprise or organization is sent to a non-company email address. This rule can be customized to alert you when a GitHub invitation is sent to an unexpected domain i.e. not one of your company's domains used for email.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a GitHub organization is removed from an enterprise.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a GitHub organization is transferred to another enterprise account. An adversary may attempt to transfer a GitHub organization to an enterprise account they control in order to steal data.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a GitHub repository is transferred.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when changes are made to a GitHub organization's fine-grained Personal Access Token approval policy.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a GitHub repository is archived or deleted.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when the visibility for a GitHub repository is changed to public.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a user is blocked from accessing repositories within a GitHub organization.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Detects when a user is unblocked from accessing repositories within a GitHub organization.
avatar
Google SecOps@GoogleSecOps
avatar
Google SecOps Detection Rules
2 years ago
100
Page 20 of 20