Browse Rules

GitHub Repository Collaborator Change

Detects when a repository collaborator is added or removed.

GitHub User Added or Removed from Org

Detects when a user is added or removed from a GitHub Org.

GitHub User Added to Org Moderators

Detects when a user is added to a GitHub org's list of moderators.

GitHub Branch Protection Disabled

Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.

GitHub Branch Protection Policy Override

Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity.

GitHub Team Modified

Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control.

GitHub Workflow Permissions Modified

Detects when the default workflow permissions for the GITHUB_TOKEN are modified at the organization level. GitHub Actions workflows use GITHUB_TOKEN for authentication, and changing these permissions can either expand or restrict what workflows can do by default. Unauthorized modifications could allow attackers to escalate privileges in CI/CD pipelines, potentially leading to supply chain compromise through malicious workflow modifications, unauthorized code deployments, or exfiltration of secre

GSuite Government Backed Attack

Detects Google Workspace warnings of government-backed attacks targeting user accounts, issued only when indicators match nation-state threat actors or APT groups. These sophisticated attacks target high-value individuals using advanced tactics including zero-day exploits, spear-phishing, and social engineering. Successful compromise can lead to persistent access, intellectual property theft, and supply chain attacks.

GitHub Actions Workflow Modification Blocked

Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.