Sigma Rules

Muhammad FaisalSun Feb 25application

Bitbucket User Login Failure Via SSH

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

bitbucketaudit

Muhammad FaisalSun Feb 25application

Bitbucket User Permissions Export Attempt

Detects user permission data export attempt.

bitbucketaudit

Detectionmediumstable

Django Framework Exceptions

Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

djangoapplication

Thomas PatzkeSat Aug 05application

Github Delete Action Invoked

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Muhammad FaisalThu Jan 19application

Outdated Dependency Or Vulnerability Alert Disabled

Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.

Muhammad FaisalFri Jan 27application

Github High Risk Configuration Disabled

Detects when a user disables a critical security feature for an organization.

Muhammad FaisalSun Jan 29application

Github Fork Private Repositories Setting Enabled/Cleared

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).

Romain GaillardMon Jul 29application

Detectioninformationaltest

New Github Organization Member Added

Detects when a new member is added or invited to a github organization.

Muhammad FaisalSun Jan 29application

Github New Secret Created

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Muhammad FaisalFri Jan 20application

Github Outside Collaborator Detected

Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.

Muhammad FaisalFri Jan 20application

Detectionlowexperimental

GitHub Repository Pages Site Changed to Public

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

Ivan SaakovSat Oct 18application

Github Push Protection Bypass Detected

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Muhammad FaisalThu Mar 07application

Github Push Protection Disabled

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Muhammad FaisalThu Mar 07application

Detectionlowexperimental

GitHub Repository Archive Status Changed

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

Ivan SaakovSat Oct 18application

Github Repository/Organization Transferred

Detects when a repository or an organization is being transferred to another location.

Romain GaillardMon Jul 29application

Github Secret Scanning Feature Disabled

Detects if the secret scanning feature is disabled for an enterprise or repository.

Muhammad FaisalThu Mar 07application

Github Self Hosted Runner Changes Detected

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Muhammad FaisalFri Jan 27application

Github SSH Certificate Configuration Changed

Detects when changes are made to the SSH certificate configuration of the organization.

Romain GaillardMon Jul 29application

Potential JNDI Injection Exploitation In JVM Based Application

Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.

Potential Local File Read Vulnerability In JVM Based Application

Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.

Potential OGNL Injection Exploitation In JVM Based Application

Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)

Process Execution Error In JVM Based Application

Detects process execution related exceptions in JVM based apps, often relates to RCE

Potential XXE Exploitation Attempt In JVM Based Application

Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.

kelnageThu Jul 11application

Kubernetes Admission Controller Modification

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

Kubernetesaudit

kelnageThu Jul 11application

Kubernetes CronJob/Job Modification

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Kubernetesaudit

Deployment Deleted From Kubernetes Cluster

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Kubernetes Events Deleted

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

Potential Remote Command Execution In Pod Container

Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.

Container With A hostPath Mount Created

Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.

Creation Of Pod In System Namespace

Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.

Detectionmediumexperimental

Kubernetes Potential Enumeration Activity

Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.

Kubernetesaudit

uniqu3-us3rTue Apr 28application

Privileged Container Deployed

Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks. A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host. Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields

RBAC Permission Enumeration Attempt

Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.