Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
411 detections
Filters
Last updated
All Time
Detection languages
181
74
63
61
11
Contributors
113
62
55
52
32
Categories
140
133
102
96
49
Platforms
309
74
43
15
15
Products / Services
10,665
9,758
6,692
4,421
3,749
411
MITRE Techniques
126
125
81
72
64
CVEs
5
1
1
1
1
Detects Gheist campaign activity: creation of a ci-sync-<6 chars> branch via stolen GitHub token followed within 10 minutes by a workflow run on that branch in the same repo. Requires GitHub audit log ingestion; table name is an assumption.
Detects a sequence of security-sensitive events in GitHub repositories where branch protection rules are modified or removed, followed closely by a force push to the protected repository, and subsequent workflow activity involving the Berri-AI/litellm repository or similar context. This pattern often indicates malicious tampering with repository controls to introduce unauthorized code.
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects repository creation or addition to an organisation. Attackers use new
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
repositories as staging ground for exfiltrated data, as hosting for second-stage
payloads under a trusted domain, or as a place to park stolen source.
Pair with the creating identity: a repository created by an account that has never
created one before is the interesting case.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB'
and action in ('REPOSITORY_CREATED', 'REPOSITORY_ADDED')
| groupby target, repositoryid, newrepositoryadded, organisationid
Detects an invitation into a GitHub organisation. Membership confers access to
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
private source and, depending on role, the ability to alter it. An unexpected
invitation is a supply chain risk: the attacker does not need to breach anything if
somebody adds them to the organisation.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='MEMBER_INVITED'
| groupby target, role, organisationid, accesstype
Detects creation of a GitHub Actions workflow. A workflow executes code on runners
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
Detects repositories being downloaded. Source code is intellectual property and
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
frequently contains embedded secrets, infrastructure detail and the logic of the
security controls themselves. Bulk download by one actor is the clearest signal of
code theft, whether by a departing engineer or a compromised account.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='REPOSITORY_DOWNLOADED'
| duration 1h
| groupby target
| select target, distinct_count(repositoryid)
| having distinct_count_col1 > 5
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects modifications, creations, or deletions of critical CI/CD pipeline configuration files (GitHub Actions, GitLab CI, Jenkins, Azure Pipelines) across cloud service logs. The rule correlates these actions with the account's historical IP baseline to identify potentially unauthorized changes originating from anomalous locations.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Page 1 of 20