Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,182 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Detects unauthorized execution of a Bun runtime executing an 'index.js' payload within a GitHub Actions workflow context, specifically targeting known compromised action paths (e.g., issues-helper, maintain-one-comment). The detection requires correlation with either sensitive environment/secret access or anomalous outbound network activity originating from the same process, indicating potential credential theft or C2 communication by a malicious CI/CD pipeline component.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Monitors GitHub Audit Logs for git pushes or workflow changes occurring after the September 16, 2026, reactivation window that reference the actions-cool/issues-helper or actions-cool/maintain-one-comment repositories. The rule excludes routine automated maintenance activity from trusted bots and common maintenance commit messages, aiming to identify unauthorized attempts to utilize or modify potentially compromised GitHub actions.
Page 280 of 756