Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
411 detections
Filters
Last updated
All Time
Detection languages
181
74
63
61
11
Contributors
113
62
55
52
32
Categories
140
133
102
96
49
Platforms
309
74
43
15
15
Products / Services
10,665
9,758
6,692
4,421
3,749
411
MITRE Techniques
126
125
81
72
64
CVEs
5
1
1
1
1
This rule detects unauthorized GitHub repository access or OAuth activity performed by a user account identified as terminated in the organization's HR system. It uses a watchlist to cross-reference GitHub audit logs against terminated employee records, applying a 2-hour grace period to account for potential log synchronization delays or final offboarding tasks.
Detects login attempts to source code repositories and developer tooling (GitHub, GitLab, Bitbucket, Azure DevOps, Slack, Visual Studio Code) originating from unmanaged or non-compliant devices, excluding traffic originating from known corporate network ranges.
Detects workflow or repository content referencing the compromised actions-cool/issues-helper or actions-cool/maintain-one-comment GitHub Actions, the known malicious commit, or the Bun-based execution of an obfuscated index.js payload
Detects a suspicious runtime pattern in GitHub Actions where a runner environment installs the Bun runtime and immediately executes an action's index.js file. This pattern is characteristic of supply chain attacks where a compromised GitHub Action uses mutable-tag pinning to smuggle and execute an obfuscated JavaScript payload before legitimate action logic.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
Detects npm package publishing events performed via GitHub Actions OIDC trusted publishing that occur without the use of a traditional npm token. This rule targets potentially unauthorized package releases triggered by automated CI/CD identities, which may indicate abuse of compromised workflows or misconfigured auto-publish settings.
This rule detects forced pushes to the main branch of a GitHub repository where a specific file named 'indexe.cjs' is added or a specific commit ID (d1d55e13) is pushed. This behavior is indicative of a supply chain compromise where an attacker rewrites git history to inject malicious loaders or backdoors into the source code.
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
Page 4 of 20