GitHub API Sensitive Resource Enumeration

MediumElastic detection rules

Detects a burst of GitHub `api.request` events from a single non-bot actor and source IP against sensitive routes such as Actions/Dependabot/environment secrets, public keys, git trees and contents, zipball archives, organization repository and member lists, webhooks, installations, and personal access tokens. Grouping by actor and source IP and requiring a high request count spread across several distinct sensitive routes separates broad enumeration from a single high-volume endpoint.

T1213T1213.003T1526T1552

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

LowElastic detection rules

GitHub API Failed Access Burst

Detects a burst of failed GitHub API requests (HTTP 4xx/5xx) recorded as `api.request`, where a single non-bot actor and source IP generate a high volume of failures spread across many distinct API routes within a short window. An adversary probing private repositories, secrets, or admin routes produces clusters of 401/403/404 responses across many endpoints, whereas broken automation usually hammers a small number of routes.

T1526

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

HighElastic detection rules

GitHub SSH Certificate Authority or Requirement Modified

Detects creation or deletion of a GitHub SSH certificate authority (CA), or disabling the requirement that members use SSH certificates, for an organization or enterprise. A CA lets an org issue short-lived SSH certificates and optionally require them in place of personal SSH keys, centralizing and time-bounding Git access. Destroying the CA or dropping the requirement makes ordinary unmanaged SSH keys acceptable again.

T1556T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

MediumElastic detection rules

GitHub Secret Scanning Push Protection Bypassed or Disabled

Detects bypass of GitHub secret scanning push protection, approval of a bypass request, or disabling push protection at enterprise, organization, or repository scope. This is separate from turning secret scanning off. Bypass means a detected secret was allowed into the repository — the pattern used after tj-actions and similar CI secret-dump attacks.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

HighElastic detection rules

GitHub SAML SSO Disabled

Detects when SAML single sign-on (SSO) is disabled for a GitHub enterprise or organization. SAML SSO delegates authentication to an external identity provider (IdP) and lets administrators enforce IdP-side controls such as MFA, conditional access, and centralized deprovisioning. Disabling it removes those controls and allows members to authenticate with GitHub credentials alone.

T1556T1556.007T1562

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

HighElastic detection rules

GitHub OAuth App Access Restrictions Disabled

Detects when OAuth App access restrictions are disabled for a GitHub organization. With restrictions enabled, only owner-approved OAuth Apps can access organization data; once disabled, any OAuth App that a member authorizes gains access without owner review. Following an account takeover, an adversary may disable restrictions and then authorize a malicious or attacker-controlled OAuth App to establish token-based persistence and exfiltrate repository data, making this a high-impact change to

T1484T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

LowElastic detection rules

GitHub Webhook Created or Configuration Changed

Detects creation or configuration change of a GitHub webhook. Attackers can add a hook to copy push, pull request, and workflow payloads (including secrets that land in those events) to an external URL.

T1213T1213.003T1567T1567.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Nov 5, 2026

MediumSigmaHQ

COM Object Execution via Xwizard.EXE

Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry.

T1218

Written by: Ensar ŞamilAttributed by SigmaHQand 3 more authors
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

LowSigmaHQ

Malicious Windows Script Components File Execution by TAEF Detection

Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe

T1218

Written by: Agro (@agro_sev) oscd.communityAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

MediumSigmaHQ

Capture Credentials with Rpcping.exe

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

T1003

Written by: Julia FominaAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

MediumSigmaHQ

SQL Client Tools PowerShell Session Detection

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

T1059.001T1127

Written by: Agro (@agro_sev) oscd.communitlyAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

HighSigmaHQ

Potential MsiExec Masquerading

Detects the execution of msiexec.exe from an uncommon directory

T1036.005

Written by: Florian Roth (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

MediumSigmaHQ

DllUnregisterServer Function Call Via Msiexec.EXE

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

T1218.007

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

CriticalSigmaHQ

HackTool - Inveigh Execution

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

T1003.001

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

HighSigmaHQ

Copying Sensitive Files with Credential Data

Files with well-known filenames (sensitive files with credential data) copying

T1003.002T1003.003

Written by: Teymur KheirkhabarovAttributed by SigmaHQand 2 more authors
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

MediumSigmaHQ

Microsoft Office Application Loading Task Scheduler DLL

Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks. This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled malicious documents attempting to establish persistence.

T1053.005T1204.002

Written by: Saksham BhattaraiAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Nov 5, 2026

InformationalSplunk security content

Windows Remote Management Execute Shell

This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe. The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.

T1021.006T1059

Written by: Drew ChurchAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Linux Compiled C Source To Tmp

The following analytic detects a C/C++ compiler compiling a C source file with the output binary written to /tmp, executed as a non-root user. This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running kernel's symbol offsets.

T1027.004T1068

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path

The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock class privilege escalation exploits. When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module.

T1068

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Linux Auditd Process Image Change Under Same PID

This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds. A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.

T1106

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Linux Auditd Inline PHP Code Execution

The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code. It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP.

T1059

Written by: Raven TaitAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

WinRM Spawning a Process

The following analytic detects suspicious processes spawned by WinRM (wsmprovhost.exe). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate exploitation attempts of vulnerabilities like CVE-2021-31166, which could lead to system instability or compromise.

T1190

Written by: Drew ChurchAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Temporary Access Pass Created

The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation. TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who creates a TAP for a compromised account can sign in from any location without any additional factor.

T1078.004T1556.006T1586.003

Written by: descambiadoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Nov 4, 2026

InformationalSplunk security content

Azure AD Suspicious Device Registration

The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)". This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments. Device registration can support persistence or provide a device identity that can be used to access internal resources.

T1098.005T1586.003

Written by: Jake EneaAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Guest User Type Changed To Member

The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member. It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values. A legacy account whose UserType was null is not a guest promotion and does not match. Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions.

T1078.004T1098T1586.003

Written by: descambiadoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumSplunk security content

Azure AD Federated Identity Credential Added To Service Principal

The following analytic detects additions of federated identity credentials to Entra ID service principals. It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty. Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret.

T1078.004T1098.001T1586.003

Written by: descambiadoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Nov 4, 2026

MediumMicrosoft Sentinel analytics

TI Map URL Entity to PaloAlto Data

This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in PaloAlto Data.

T1071

Licence: MIT License
Published: Nov 4, 2026

MediumMicrosoft Sentinel analytics

TI Map Domain entity to PaloAlto

Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI

T1071

Licence: MIT License
Published: Nov 4, 2026

MediumMicrosoft Sentinel analytics

TI Map Domain entity to PaloAlto CommonSecurityLog

Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI

T1071

Licence: MIT License
Published: Nov 4, 2026

MediumMicrosoft Sentinel analytics

OracleDBAudit - Shutdown Server

Detects when "SHUTDOWN" command was sent to server.

T1529

Licence: MIT License
Published: Nov 4, 2026

Reference	Class	Cited by
docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#enabling-api-request-events	Unclassified	15from 2 sources
securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/	Unclassified	3

Detection rules

GitHub API Sensitive Resource Enumeration

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules