github Sigma detection rules

Detects when a user disables a critical security feature for an organization.

github · audit

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

github · audit

Detects if the secret scanning feature is disabled for an enterprise or repository.

github · audit

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

github · audit

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

github · audit

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

github · audit

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

github · audit

Detects when a repository or an organization is being transferred to another location.

github · audit

Detects when changes are made to the SSH certificate configuration of the organization.

github · audit

Detects when a user creates action secret for the organization, environment, codespaces or repository.

github · audit

Detects when a user bypasses the push protection on a secret detected by secret scanning.

github · audit

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

github · audit

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

github · audit

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

github · audit

Detects when a new member is added or invited to a github organization.

github · audit