Detection rules › By catalog entry

GitHub-git

Catalog entry	Rules
git.clone	5
git.push	2

git.clone

5 detection rules reference this catalog entry. View catalog entry.

Elastic (3)

Github Activity on a Private Repository from an Unusual IP severity low T1059,T1078,T1078.004,T1195,T1195.002,T1213
GitHub Exfiltration via High Number of Repository Clones by User severity medium T1020,T1213,T1213.003,T1567,T1567.001
High Number of Cloned GitHub Repos From PAT severity low T1213,T1213.003,T1648

YARA-L (2)

GitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories severity high T1213,T1213.003
GitHub High Number Of Non Public GitHub Repositories Cloned severity high T1213,T1213.003

git.push

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

GitHub Actions Unusual Bot Push to Repository severity low T1059,T1195,T1195.002,T1565,T1565.001
Github Activity on a Private Repository from an Unusual IP severity low T1059,T1078,T1078.004,T1195,T1195.002,T1213

Back to all GitHub-git catalog entries