Data from Information Repositories: Code Repositories `T1213.003`

Tactic: Collection

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Authoring guide

These 14 rules share fields, values, and exclusions.

Fields filtered most (19 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	4	`eq` 2, `in` 1, `wildcard` 1	`git.clone`, `Process Create*`, `ProcessRollup2`, `exec`, `git.push`
`github.repository_public`	4	`eq` 4	`false`
`EventID`	3	`eq` 3	`git.clone`, `personal_access_token.access_granted`, `repo.download_zip`
`action`	3	`eq` 3	`codespaces.destroy`, `environment.delete`, `org.remove_outside_collaborator`, `org.remove_self_hosted_runner`, `org.runner_group_created`
`data_stream.dataset`	3	`eq` 3	`github.audit`
`event.category`	3	`eq` 3	`configuration`
`auditType.action`	2	`eq` 2	`full data export triggered`, `unauthorized full data export triggered`
`auditType.category`	2	`eq` 2	`data pipeline`
`event.dataset`	2	`eq` 2	`github.audit`
`event.type`	2	`eq` 2	`change`, `start`
`github.repo`	2	`is_not_null` 2
`Esql.event_count`	1	`ge` 1	`25`
`SubjectUserName`	1	`macro` 1	`github_clone.principal.user.userid`
`extracted.fields["public_repo"]`	1	`eq` 1	`false`
`extracted.fields["repository_public"]`	1	`eq` 1	`false`

Top indicator values (45 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`github.repository_public`	`eq`	`false` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticGithub Activity on a Private Repository from an Unusual IP elasticHigh Number of Cloned GitHub Repos From PAT	4	5
`data_stream.dataset`	`eq`	`github.audit` elasticGithub Activity on a Private Repository from an Unusual IP elasticGitHub Exfiltration via High Number of Repository Clones by User elasticHigh Number of Cloned GitHub Repos From PAT	3	18
`event.category`	`eq`	`configuration` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticHigh Number of Cloned GitHub Repos From PAT	3	13
`EventID`	`eq`	`git.clone` chronicleGitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories chronicleGitHub High Number Of Non Public GitHub Repositories Cloned	2	2
`EventID`	`eq`	`personal_access_token.access_granted` chronicleGitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories	1
`EventID`	`eq`	`repo.download_zip` chronicleGitHub High Number Of Non Public GitHub Repositories Downloaded	1
`EventType`	`eq`	`git.clone` elasticGitHub Exfiltration via High Number of Repository Clones by User elasticHigh Number of Cloned GitHub Repos From PAT	2	2
`auditType.category`	`eq`	`data pipeline` sigmaBitbucket Full Data Export Triggered sigmaBitbucket Unauthorized Full Data Export Triggered	2	2
`event.dataset`	`eq`	`github.audit` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo	2	14
`Esql.event_count`	`ge`	`25` elasticGitHub Exfiltration via High Number of Repository Clones by User	1
`EventType`	`in`	`git.clone` elasticGithub Activity on a Private Repository from an Unusual IP	1
`EventType`	`in`	`git.push` elasticGithub Activity on a Private Repository from an Unusual IP	1
`EventType`	`wildcard`	`Process Create*` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`ProcessRollup2` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`exec` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`exec_event` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`executed` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`process_started` elasticPotential Secret Scanning via Gitleaks	1	2
`EventType`	`wildcard`	`start` elasticPotential Secret Scanning via Gitleaks	1	2
`SubjectUserName`	`macro`	`github_clone.principal.user.userid` chronicleGitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories	1
`action`	`eq`	`codespaces.destroy` sigmaGithub Delete Action Invoked	1
`action`	`eq`	`environment.delete` sigmaGithub Delete Action Invoked	1
`action`	`eq`	`org.remove_outside_collaborator` sigmaGithub Outside Collaborator Detected	1
`action`	`eq`	`org.remove_self_hosted_runner` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_created` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_removed` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_runner_removed` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_runners_added` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_runners_updated` sigmaGithub Self Hosted Runner Changes Detected	1
`action`	`eq`	`org.runner_group_updated` sigmaGithub Self Hosted Runner Changes Detected	1

Data from Information Repositories: Code Repositories `T1213.003`

Authoring guide

Fields filtered most (19 distinct)

Top indicator values (45 distinct)

Rules under this technique

Sigma 5 rules

Elastic 6 rules

YARA-L 3 rules

Data from Information Repositories: Code Repositories T1213.003

Authoring guide

Fields filtered most (19 distinct)

Top indicator values (45 distinct)

Rules under this technique

Sigma 5 rules

Elastic 6 rules

YARA-L 3 rules

Data from Information Repositories: Code Repositories `T1213.003`