Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
200 detections
Filters
Last updated
All Time
Detection languages
129
38
13
11
4
Contributors
122
37
20
9
5
Categories
61
57
39
35
31
Platforms
123
58
39
12
8
Products / Services
10,665
9,758
6,692
4,421
3,749
MITRE Techniques
49
46
32
28
27
CVEs
10
10
3
3
3
IDS Classtypes
8
3
2
IDS Protocols
13
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects unreviewed commits to .gitlab-ci.yml that alter how the gitlab-triage tool invokes the sensitive API_TOKEN variable, with no associated merge request.
Detects unreviewed commits to .gitlab-ci.yml that alter how the gitlab-triage tool invokes the sensitive API_TOKEN variable, with no associated merge request.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects an Owner-role GitLab account or token modifying merge-request approval rules, protected-branch settings, or project membership -- controls that, if weakened, defeat code-review safeguards.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects unauthenticated GET requests to GitLab CI/CD job artifact download endpoints on a public repository, which can expose leaked secrets bundled into build artifacts.
Detects unauthenticated GET requests to GitLab CI/CD job artifact download endpoints on a public repository, which can expose leaked secrets bundled into build artifacts.
Detects unauthenticated GET requests to GitLab CI/CD job artifact download endpoints on a public repository, which can expose leaked secrets bundled into build artifacts.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Page 6 of 10