Data Source: Github

GitHub Exfiltration via High Number of Repository Clones by User

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Exfiltration Data Source: Github Resources: Investigation Guide ·

Share on:

Detects a high number of repository cloning actions by a single user within a short time frame. Adversaries may clone multiple repositories to exfiltrate sensitive data.

GitHub Private Repository Turned Public

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Exfiltration Tactic: Impact Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when a private GitHub repository is changed to public visibility. Adversaries may change repository visibility to public in order to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

GitHub Secret Scanning Disabled

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Defense Evasion Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when GitHub Secret Scanning is disabled for a repository. Adversaries may disable secret scanning to evade detection of hardcoded secrets, such as API keys or credentials, that could be used for further compromise or data exfiltration.

High Number of Closed Pull Requests by User

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Impact Tactic: Exfiltration Data Source: Github Resources: Investigation Guide ·

Share on:

Detects a high number of closed pull requests by a single user within a short time frame. Adversaries may close multiple pull requests to disrupt development workflows or hide malicious changes.

High Number of Protected Branch Force Pushes by User

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Impact Tactic: Exfiltration Data Source: Github Resources: Investigation Guide ·

Share on:

Detects a high number of force push actions to protected branches by a single user within a short time frame. Adversaries may perform force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.

New GitHub Personal Access Token (PAT) Added

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Persistence Tactic: Credential Access Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when a new GitHub Personal Access Token (PAT) is created. Adversaries may create new PATs to maintain persistent access to a compromised account or to escalate privileges within an organization.

Several Failed Protected Branch Force Pushes by User

Jan 12, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Impact Tactic: Exfiltration Data Source: Github Resources: Investigation Guide ·

Share on:

Detects a high number of failed force push attempts to protected branches by a single user within a short time frame. Adversaries may attempt multiple force pushes to overwrite commit history on protected branches, potentially leading to data loss or disruption of development workflows.

Github Activity on a Private Repository from an Unusual IP

Jan 8, 2026 · Domain: Cloud Use Case: Threat Detection Tactic: Impact Tactic: Initial Access Tactic: Persistence Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when there is activity on a private GitHub repository from an unusual IP address. Adversaries may access private repositories from unfamiliar IPs to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access.

GitHub Actions Unusual Bot Push to Repository

Dec 18, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Initial Access Tactic: Persistence Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when the github-actions[bot] pushes code to a repository where it has not performed this behavior before in a certain time window. This may indicate a supply chain attack where malicious code running in a CI workflow attempts to modify repository contents, such as injecting backdoor workflow files.

GitHub Actions Workflow Modification Blocked

Dec 17, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Initial Access Tactic: Persistence Tactic: Execution Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.

New GitHub Self Hosted Action Runner

Dec 10, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Initial Access Data Source: Github Resources: Investigation Guide ·

Share on:

This rule detects the creation of a self-hosted Github runner from a first time seen user.name in the last 5 days. Adversaries may abuse self-hosted runners to execute workflow jobs on customer infrastructure.

GitHub App Deleted

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Execution Data Source: Github Resources: Investigation Guide ·

Share on:

Detects the deletion of a GitHub app either from a repo or an organization.

GitHub Owner Role Granted To User

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Use Case: UEBA Tactic: Persistence Data Source: Github Resources: Investigation Guide ·

Share on:

This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.

GitHub Protected Branch Settings Changed

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Defense Evasion Data Source: Github Resources: Investigation Guide ·

Share on:

This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.

GitHub Repository Deleted

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Use Case: UEBA Tactic: Impact Data Source: Github Resources: Investigation Guide ·

Share on:

This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.

GitHub UEBA - Multiple Alerts from a GitHub Account

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Use Case: UEBA Tactic: Execution Rule Type: Higher-Order Rule Data Source: Github Resources: Investigation Guide ·

Share on:

This rule is part of the "GitHub UEBA - Unusual Activity from Account Pack", and leverages alert data to determine when multiple alerts are executed by the same user in a timespan of one hour. Analysts can use this to prioritize triage and response, as these alerts are a higher indicator of compromised user accounts or PATs.

High Number of Cloned GitHub Repos From PAT

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Use Case: UEBA Tactic: Execution Data Source: Github Resources: Investigation Guide ·

Share on:

Detects a high number of unique private repo clone events originating from a single personal access token within a short time period.

New GitHub App Installed

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Tactic: Execution Data Source: Github Resources: Investigation Guide ·

Share on:

This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.

New GitHub Owner Added

Mar 20, 2025 · Domain: Cloud Use Case: Threat Detection Use Case: UEBA Tactic: Persistence Data Source: Github Resources: Investigation Guide ·

Share on:

Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.