Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
411 detections
Filters
Last updated
All Time
Detection languages
181
74
63
61
11
Contributors
113
62
55
52
32
Categories
140
133
102
96
49
Platforms
309
74
43
15
15
Products / Services
10,665
9,758
6,692
4,421
3,749
411
MITRE Techniques
126
125
81
72
64
CVEs
5
1
1
1
1
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects repository activity involving the 'FETCH_HEAD' reference, which often indicates automated fetching, local caching, or potential attempts to manipulate or inspect the state of a Git repository during reconnaissance or post-exploitation activities.
Detects a 'force-push' operation in a Git repository where the pushed commit is not cryptographically signed. This behavior is often indicative of repository tampering, such as overwriting commit history to remove audit trails, hide malicious code injection, or facilitate unauthorized repository modifications.
Detects suspicious activities in GitHub audit logs that could indicate RepoJacking or SkillJacking attempts, specifically focusing on repository ownership transfers, default branch modifications, repository deletion, and changes to organizational membership or roles.
This rule performs a wide aggregation of logs across proxy, cloud, GitHub, and network destination data sources. Because it lacks specific filtering logic or behavioral indicators, it does not detect any specific attack technique and serves only as a broad data collection query.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Page 7 of 20