github

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Github Push Protection Bypass Detected

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Github Push Protection Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Github Repository/Organization Transferred

Aug 12, 2024 · attack.persistence attack.t1020 attack.t1537 ·

Share on:

Detects when a repository or an organization is being transferred to another location.

Github Secret Scanning Feature Disabled

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Github SSH Certificate Configuration Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

New Github Organization Member Added

Aug 12, 2024 · attack.persistence attack.t1136.003 ·

Share on:

Detects when a new member is added or invited to a github organization.

Outdated Dependency Or Vulnerability Alert Disabled

Aug 12, 2024 · attack.initial-access attack.t1195.001 ·

Share on:

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.