attack.t1213.003

Bitbucket Full Data Export Triggered

Aug 12, 2024 · attack.collection attack.t1213.003 ·

Share on:

Detects when full data export is attempted.

Bitbucket Unauthorized Full Data Export Triggered

Aug 12, 2024 · attack.collection attack.resource-development attack.t1213.003 attack.t1586 ·

Share on:

Detects when full data export is attempted an unauthorized user.

Github Delete Action Invoked

Aug 12, 2024 · attack.impact attack.collection attack.t1213.003 ·

Share on:

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Github Outside Collaborator Detected

Aug 12, 2024 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·

Share on:

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.