Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,181 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a user grants access to a GitHub Personal Access Token (PAT) and subsequently clones a high number of non-public GitHub repositories. This behavior can indicate an adversary attempting to steal the contents of multiple GitHub repositories using an automated script or offensive tool after gaining access to a PAT.
Detects when third-party application access restrictions are disabled for a GitHub organization. This action can increase the attack surface by allowing unauthorized or malicious OAuth applications to access organization resources.
Detects when a GitHub repository transfer is initiated. This event indicates that a user has started the process of transferring ownership of a repository to another user or organization. This could be a legitimate administrative action but also a precursor to data exfiltration or unauthorized access if performed maliciously.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.
This rule detects when an invitation to join a GitHub enterprise or organization is sent to an email address that does not belong to a company-managed domain. It specifically looks for 'business.invite_admin', 'business.invite_billing_manager', or 'org.invite_member' events where the invitee's email address does not match the configured company domain regex.
Page 37 of 76