tayvion payton
@tayontechCompletionist
1 follower219 downloads95 copies16 likes1,887 views
14 detections
Filters
Last updated
All Time
Detection languages
14
Categories
9
7
7
3
2
Platforms
7
7
Products / Services
7
6
2
1
1
MITRE Techniques
10
10
8
6
6
Detects programmatic GitHub data exfiltration by identifying non-interactive repository exports, clones, artifact downloads, or gist staging performed using tokens, OAuth applications, or GitHub Apps. The detection focuses on bursty or multi-repository activity within a short time window, which can indicate automated source code collection, misuse of programmatic credentials, or post-compromise data extraction.
Detects when a new AWS IAM Principal (User, Role, or Group) is created and then has a policy attached to it by the same actor within a 10-minute time frame. This sequence is a suspicious TTP often used by attackers to provision a new, privileged "shadow" account or role for persistence and lateral movement, bypassing existing accounts or role assumption paths.
Detects a suspicious sequence where a new credential (PAT, SSH key, or OAuth authorization) is created and then used to establish durable persistence via webhooks or deploy keys. This behavior typically occurs after an account compromise as an attacker attempts to "lock in" access that survives credential rotation and provides real-time exfiltration of repository data.
Detects a sequence of events where an AWS IAM Policy is modified or created and then immediately attached to a principal (user, role, or group) within a short time window (10 minutes). This behavior is highly suspicious and often indicates a rapid privilege escalation attempt or a lateral movement step where an attacker grants themselves new permissions for immediate use.
Detects the addition of an SSH public key to a GitHub account using programmatic access (Personal Access Tokens, OAuth, or GitHub Apps). Unlike keys added via the Web UI, programmatic creation often bypasses manual verification steps and provides long-lived access that survives password resets and MFA changes. This is a common technique for attackers to establish persistent command line access to repositories.
Detects the creation of a new Personal Access Token (PAT) in GitHub. Attackers frequently create PATs after gaining initial access to an account to maintain persistence that survives a password reset. Tokens with broad scopes (repo, admin:org) allow for full repository exfiltration and administrative manipulation of the organization.
Detects the creation or modification of repository webhooks in GitHub. Attackers can use webhooks for real-time data exfiltration of code pushes, pull request comments, and workflow data. Once a webhook is established, it operates independently of the creating user; revoking the creator's credentials will NOT stop the data flow. Only deleting the webhook itself terminates the exfiltration.
This alert identifies a potential bypass of repository governance controls. It triggers when a GitHub repository's default branch is changed and then reverted or updated again within a 24-hour window. By temporarily changing the default branch to an unprotected branch, an actor can push code or merge pull requests to the primary branch (e.g., main) without satisfying mandatory status checks or peer review requirements.
Detects a sequence of events where an AWS IAM Role Trust Policy or a Role's managed policy is modified (UpdateAssumeRolePolicy, PutRolePolicy) and is immediately followed by a successful assumption of that role (AssumeRole, AssumeRoleWithSAML, etc.) within a 10-minute window. This behavior is characteristic of an attacker setting up a backdoor or escalating privileges by granting a new, unauthorized principal (user, service, or account) permission to assume a critical role.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Page 1 of 2