Browse Rules

GitHub Repo Created

A new GitHub repository was created.

GitHub PAT Access Revoked

Access to private GitHub organization resources was revoked for a PAT.

GitHub User Blocked From Organization

A GitHub user was blocked from access to an organization.

New User Added To GitHub Organization

A new user was added to a GitHub organization.

First Occurrence of IP Address For GitHub User

Detects a new IP address used for a GitHub user not previously seen in the last 14 days.

First Occurrence of User-Agent For a GitHub User

Detects a new user agent used for a GitHub user not previously seen in the last 14 days.

Member Removed From GitHub Organization

A member was removed or their invitation to join was removed from a GitHub Organization.

First Occurrence of IP Address For GitHub Personal Access Token (PAT)

Detects a new IP address used for a GitHub PAT not previously seen in the last 14 days.

First Occurrence of GitHub User Interaction with Private Repo

Detects a new private repo interaction for a GitHub user not seen in the last 14 days.

Lazarus APT DLL Sideloading Activity

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

First Occurrence of User Agent For a GitHub Personal Access Token (PAT)

Detects a new user agent used for a GitHub PAT not previously seen in the last 14 days.

Entra ID Protection - Risk Detection - User Risk

Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.

First Occurrence of Personal Access Token (PAT) Use For a GitHub User

A new PAT was used for a GitHub user not previously seen in the last 14 days.

Lazarus APT DLL Sideloading Activity

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Entra ID Protection - Risk Detection - Sign-in Risk

Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more.

SentinelOne Threat External Alerts

Generates a detection alert for each SentinelOne threat written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne threat alerts in the app.

First Occurrence GitHub Event for a Personal Access Token (PAT)

Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.

Snowflake Alter Stage [snowflake-database_query_history]

This use case detects the ALTER STAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Create Share [snowflake-database_query_history]

This use case detects the CREATE SHARE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Create Stage [snowflake-database_query_history]

This use case detects the CREATE STAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Drop Database [snowflake-database_query_history]

This use case detects the DROP DATABASE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Drop Stage [snowflake-database_query_history]

This use case detects the DROP STAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Drop Table [snowflake-database_query_history]

This use case detects the DROP TABLE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

Snowflake Monitor Usage [snowflake-database_query_history]

This use case detects the MONITOR USAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

First Occurrence of GitHub Repo Interaction From a New IP

Detects an interaction with a private GitHub repository from a new IP address not seen in the last 14 days.