Detection rules › By event

GitHub-git

Event	Rules
git.clone	6
git.fetch	1
git.push	3

git.clone

6 detection rules reference this event. View event page.

Elastic (3)

Github Activity on a Private Repository from an Unusual IP severity low T1059, T1078, T1078.004, T1195, T1195.002, T1213
GitHub Exfiltration via High Number of Repository Clones by User severity medium T1020, T1213, T1213.003, T1567, T1567.001
High Number of Cloned GitHub Repos From PAT severity low T1213, T1213.003, T1648

YARA-L (2)

GitHub Access Granted To Personal Access Token Followed By High Number Of Cloned Non Public Repositories severity high T1213, T1213.003
GitHub High Number Of Non Public GitHub Repositories Cloned severity high T1213, T1213.003

Panther (1)

GitHub User Initial Access to Private Repo severity informational

git.fetch

1 detection rules reference this event. View event page.

Panther (1)

GitHub User Initial Access to Private Repo severity informational

git.push

3 detection rules reference this event. View event page.

Elastic (2)

GitHub Actions Unusual Bot Push to Repository severity low T1059, T1195, T1195.002, T1565, T1565.001
Github Activity on a Private Repository from an Unusual IP severity low T1059, T1078, T1078.004, T1195, T1195.002, T1213

Panther (1)

GitHub User Initial Access to Private Repo severity informational