Detects a burst of GitHub api.request events from a single non-bot actor and source IP against sensitive routes such as Actions/Dependabot/environment secrets, public keys, git trees and contents, zipball archives, organization repository and member lists, webhooks, installations, and personal access tokens. Grouping by actor and source IP and requiring a high request count spread across several distinct sensitive routes separates broad enumeration from a single high-volume endpoint. This pattern is commonly used for credential discovery and source collection after token theft. Requires GitHub Enterprise audit log streaming with API Request Events enabled.

Read More

Detects creation or configuration change of a GitHub webhook. Attackers can add a hook to copy push, pull request, and workflow payloads (including secrets that land in those events) to an external URL.

Read More

Detects when OAuth App access restrictions are disabled for a GitHub organization. With restrictions enabled, only owner-approved OAuth Apps can access organization data; once disabled, any OAuth App that a member authorizes gains access without owner review. Following an account takeover, an adversary may disable restrictions and then authorize a malicious or attacker-controlled OAuth App to establish token-based persistence and exfiltrate repository data, making this a high-impact change to the organization's third-party access controls.

Read More

Detects a burst of failed GitHub API requests (HTTP 4xx/5xx) recorded as api.request, where a single non-bot actor and source IP generate a high volume of failures spread across many distinct API routes within a short window. An adversary probing private repositories, secrets, or admin routes produces clusters of 401/403/404 responses across many endpoints, whereas broken automation usually hammers a small number of routes. Grouping by actor and source IP and requiring both a high failure count and a high number of distinct routes separates broad enumeration from a single misconfigured integration. Requires API Request Events on GitHub audit log streaming.

Read More

Detects when SAML single sign-on (SSO) is disabled for a GitHub enterprise or organization. SAML SSO delegates authentication to an external identity provider (IdP) and lets administrators enforce IdP-side controls such as MFA, conditional access, and centralized deprovisioning. Disabling it removes those controls and allows members to authenticate with GitHub credentials alone. Following an account takeover, an adversary may disable SSO to evade IdP-enforced access policies and maintain access that survives IdP-side session revocation and deprovisioning, making this a high-impact identity-control change.

Read More

Detects creation or deletion of a GitHub SSH certificate authority (CA), or disabling the requirement that members use SSH certificates, for an organization or enterprise. A CA lets an org issue short-lived SSH certificates and optionally require them in place of personal SSH keys, centralizing and time-bounding Git access. Destroying the CA or dropping the requirement makes ordinary unmanaged SSH keys acceptable again. Following an account takeover, an adversary may make these changes to authenticate with keys the organization does not manage and evade certificate-based access control, making this a high-impact change to Git access controls.

Read More

Detects bypass of GitHub secret scanning push protection, approval of a bypass request, or disabling push protection at enterprise, organization, or repository scope. This is separate from turning secret scanning off. Bypass means a detected secret was allowed into the repository — the pattern used after tj-actions and similar CI secret-dump attacks.

Read More

Detects a high number of force push actions to protected branches by a single user within a short time frame. Adversaries may perform force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.

Read More

Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can access organization resources; once enabled, members' PAT requests gain access without that review, removing a key control over programmatic access. Following an account takeover, an adversary with owner access may enable auto-approval to quietly provision long-lived, organization-scoped tokens for persistence and data access, making this a high-impact change to the organization's programmatic-access controls.

Read More

Detects when the organization control that restricts personal access token (PAT) access to GitHub organization resources is disabled. With the restriction enabled, classic and fine-grained PATs cannot reach organization-owned resources; once disabled, any member's PAT can access private repositories again without owner enforcement. Following an account takeover, an adversary may disable this restriction so that a leaked or attacker-created PAT regains access to organization data, establishing token-based persistence and a data-exfiltration path, making this a high-impact change to the organization's programmatic-access controls.

Read More

Detects when the two-factor authentication (2FA) requirement is disabled for a GitHub organization or enterprise. Removing the requirement downgrades every member in scope to password-only authentication and allows new members to be added without 2FA. Following an account takeover, an adversary may disable the requirement to preserve password-based access, reduce friction for enrolling attacker-controlled accounts, and lower the organization's overall account-takeover resistance, making this a high-impact identity-control change.

Read More

Detects changes to a GitHub organization IP allow list: creating, updating, or deleting allow-list entries, or enabling/disabling allow-list enforcement (including enforcement for installed GitHub Apps, the IdP-provided web allow list, and user-level enforcement). Adversaries with org-owner access may add or modify their own address, then enable enforcement, or weaken enforcement and remove legitimate entries to lock out administrators.

Read More

Detects GitHub secret scanning creating an alert for a secret that it has determined is publicly leaked ("github.publicly_leaked == true"). Unlike a generic secret-scanning finding, a publicly leaked secret means GitHub observed the credential exposed outside the repository's access boundary (for example in a public repository, gist, or other public location), so it should be treated as a confirmed credential compromise requiring immediate rotation rather than a low-signal scanner event. Gating on the public-leak flag also removes most of the noise from dummy strings and test fixtures, which are typically confined to private repositories and are not flagged as publicly leaked.

Read More

Detects when Dependabot alerts or security updates are disabled at the repository, organization, or enterprise level in GitHub. Adversaries may turn off Dependabot to reduce the chance that a malicious or vulnerable dependency they introduced is flagged; disabling it for an organization or enterprise removes this coverage across many repositories at once.

Read More

Detects when a GitHub Enterprise audit log streaming destination is updated or deleted. Adversaries who gain enterprise admin access may change the stream sink or destroy it to stop security telemetry from reaching the SIEM, or to redirect audit events to attacker-controlled storage.

Read More

Detects GitHub Advanced Security being disabled for an enterprise, for all or new repositories in an organization, for existing or new user-namespace repositories, or for selected members via enterprise policy. Disabling GHAS removes secret scanning, code scanning, and related controls.

Read More

Detects viewing, downloading, printing, generating, or using GitHub enterprise or organization SSO recovery codes. These codes bypass the IdP and are break-glass credentials.

Read More

Detects enabling of private repository forking on a GitHub organization. Allowing forks of private repositories lets code leave the organization into personal forks, which is a common collection path after an org-owner compromise.

Read More

Detects when a GitHub user pushes to or clones a private repository from an autonomous system (ASN) not previously seen for that user in the last 7 days. The source IP is resolved to its ASN at query time, so address churn inside the same ISP or cloud provider does not produce new alerts. Adversaries may access private repositories from unfamiliar ASNs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

Read More

This rule detects protected branch setting changes on a GitHub repository originating from a user agent not previously seen performing protected branch changes in the last 7 days. Branch protection rules enforce workflows and requirements before a contributor can push changes to a branch. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks. Both push-time enforcement events (protected_branch.rejected_ref_update, a push blocked by branch protection) and administrative bypasses (protected_branch.policy_override) are retained, because a failed modification attempt and an admin override are each security-relevant indicators, particularly during CI/CD compromise once administrative access is obtained. Keying on a new user agent suppresses the recurring, expected automation that drives most of the event volume while surfacing changes from unfamiliar tooling or clients. If a specific user agent is noisy in a given environment, scope it with an exception rather than removing the action from the query.

Read More

This rule detects the registration of a self-hosted GitHub Actions runner by a user and source ASN (autonomous system) pair not seen in the last 5 days. The source IP is resolved to its ASN at query time, so address churn inside the same ISP or cloud provider does not produce new alerts. Adversaries may abuse self-hosted runners to execute workflow jobs on customer infrastructure.

Read More

Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until revoked and can clone or ZIP private repositories. This is not a GitHub App installation (integration_installation.create).

Read More

Detects when the github-actions[bot] pushes code to a repository where it has not performed this behavior before in a certain time window. This may indicate a supply chain attack where malicious code running in a CI workflow attempts to modify repository contents, such as injecting backdoor workflow files.

Read More

Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.

Read More

Detects the deletion of a GitHub app either from a repo or an organization.

Read More

Detects a high number of repository cloning actions by a single user within a short time frame. Adversaries may clone multiple repositories to exfiltrate sensitive data.

Read More

This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

Read More

Detects when a private GitHub repository is changed to public visibility. Adversaries may change repository visibility to public in order to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

Read More

This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.

Read More

Detects when GitHub Secret Scanning is disabled for a repository. Adversaries may disable secret scanning to evade detection of hardcoded secrets, such as API keys or credentials, that could be used for further compromise or data exfiltration.

Read More

This rule is part of the "GitHub UEBA - Unusual Activity from Account Pack", and leverages alert data to determine when multiple alerts are executed by the same user in a timespan of one hour. Analysts can use this to prioritize triage and response, as these alerts are a higher indicator of compromised user accounts or PATs.

Read More

Detects a high number of unique private repo clone events originating from a single personal access token within a short time period.

Read More

Detects a high number of closed pull requests by a single user within a short time frame. Adversaries may close multiple pull requests to disrupt development workflows or hide malicious changes.

Read More

This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.

Read More

Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

Read More

Detects when a new GitHub Personal Access Token (PAT) is created. Adversaries may create new PATs to maintain persistent access to a compromised account or to escalate privileges within an organization.

Read More

Detects a high number of failed force push attempts to protected branches by a single user within a short time frame. Adversaries may attempt multiple force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.

Read More