Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
68 detections
Filters
Last updated
All Time
Detection languages
42
10
6
3
3
Contributors
36
9
5
3
2
Categories
23
12
12
10
7
Platforms
22
17
16
12
7
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
19
13
13
13
13
CVEs
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects Gheist campaign activity: creation of a ci-sync-<6 chars> branch via stolen GitHub token followed within 10 minutes by a workflow run on that branch in the same repo. Requires GitHub audit log ingestion; table name is an assumption.
Detects malicious tampering with GitHub Actions workflows by monitoring for two specific patterns within an hour: the addition of automatic push triggers for the main branch alongside the removal of manual approval gates, or rapid sequential commits that rewrite workflows to facilitate an unattended publish of a package. This rule also integrates with npm registry publish events to identify potential malicious distribution of compromised packages like @dforge-core/dforge-mcp.
Detects workflow or repository content referencing the compromised actions-cool/issues-helper or actions-cool/maintain-one-comment GitHub Actions, the known malicious commit, or the Bun-based execution of an obfuscated index.js payload
Detects GitHub push events where the actor pushing the changes does not match the commit author or committer identities, and the commit is not cryptographically signed. This pattern may indicate credential theft or account compromise where an adversary is pushing code using stolen credentials or impersonating authorized users.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
This rule performs a wide aggregation of logs across proxy, cloud, GitHub, and network destination data sources. Because it lacks specific filtering logic or behavioral indicators, it does not detect any specific attack technique and serves only as a broad data collection query.
Detects potential command injection on GitHub Actions self-hosted runners where a child shell process (bash/sh) is spawned by the Runner.Worker or Runner.Listener processes. The rule looks for a specific pattern of shell command lines containing single quotes, semicolons, and the 'echo' command, which is indicative of a breakout attack exploiting unsanitized GitHub event data (e.g., issue titles) being passed into shell commands.
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
Detects suspicious activity within GitHub Actions, identifying potential exfiltration or malicious automation by correlating signals such as masquerading actors (e.g., bots like dependabot), specific IronWorm-associated commit message patterns, usage of secrets-related JSON expressions in logs, and the use of innocuous file names for artifact uploads.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
This rule detects misconfigurations in GitHub Actions workflows related to Claude automation. Specifically, it looks for workflow files (.yml or .yaml) within the '.github/workflows' directory where the initiating process command line contains 'allowed_non_write_users' or 'claude-code-action' along with a wildcard ('*') in the user permissions. Such a configuration could allow unauthorized users to trigger code changes via AI actions on a repository, indicating a potential security vulnerability.
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
This rule detects attempts to upload potentially malicious script or executable files to GitHub's API. It specifically looks for HTTP POST requests to 'api.github.com' with a URI containing '/contents/' and file data matching common executable or script file extensions such as '.exe', '.dll', '.ps1', '.vbs', '.bat', or '.hta'. This activity could indicate an attacker attempting to stage malicious code in a code repository.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.
Page 1 of 4