Ruben Groenewoud d1335dd374 [New Rules] Several GitHub Related Rules (#5470) ...

* [New Rules] Several GitHub Related Rules

* Added additional references

* Update defense_evasion_secret_scanning_disabled.toml

* Update persistence_new_pat_created.toml

* Added two more rules

* ++

* Update rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml

* Added github.repository_public to non_ecs

* Update impact_github_repository_activity_from_unusual_ip.toml

* Update rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml

* ++

* Update rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml

* Update rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml

* Update rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml

* ++

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

(cherry picked from commit 34daf12d51)

2026-01-08 16:20:38 +00:00

..

defense_evasion_github_protected_branch_settings_changed.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

defense_evasion_secret_scanning_disabled.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

execution_github_app_deleted.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

execution_github_high_number_of_cloned_repos_from_pat.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

execution_github_ueba_multiple_behavior_alerts_from_account.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

execution_new_github_app_installed.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

exfiltration_github_private_repository_turned_public.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

exfiltration_high_number_of_cloning_by_user.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

impact_github_repository_activity_from_unusual_ip.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

impact_github_repository_deleted.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

impact_high_number_of_closed_pull_requests_by_user.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

impact_high_number_of_protected_branch_force_pushes_by_user.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

initial_access_github_actions_bot_first_push_to_repo.toml

[New Rule] GitHub Actions Bot Pushed to Repository for First Time (#5438)

2025-12-18 15:00:30 +00:00

initial_access_github_actions_workflow_injection_blocked.toml

[New Rule] GitHub Actions Workflow Injection Blocked (#5433)

2025-12-17 19:31:06 +00:00

initial_access_github_register_self_hosted_runner.toml

[Rule Tuning] New GitHub Self Hosted Action Runner (#5436)

2025-12-10 15:57:17 +00:00

persistence_github_org_owner_added.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00

persistence_new_pat_created.toml

[New Rules] Several GitHub Related Rules (#5470)

2026-01-08 16:20:38 +00:00

persistence_organization_owner_role_granted.toml

Prep for Release 9.0 (#4550)

2025-03-20 15:07:35 +00:00