Github Self Hosted Runner Changes Detected
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.
Github Delete Action InvokedJan 30, 2023 · attack.impact attack.collection attack.t1213.003 ·
Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Github Outside Collaborator DetectedJan 30, 2023 · attack.persistence attack.collection attack.t1098.001 attack.t1098.003 attack.t1213.003 ·
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.