GitHub Detection Pack
42 detection rules for GitHub audit logs — covering secrets exposure, supply chain attacks via Actions workflows, insider repository access, and CI/CD pipeline tampering. One-click activation.
Pack summary
- Detection rules
- 42
- Critical severity
- 10
- Log sources
- 4
- ATT&CK techniques
- 14
What's included
42 rules across 5 threat categories for GitHub security threats.
Actions workflow tampering, self-hosted runner addition, branch protection bypass, package publishing.
Secret Scanning alerts, PAT with admin scope, deploy key addition, secrets accessed by forks.
Mass repository clone, outside collaborator addition, repository deletion, SAML bypass.
Org admin role grants, security policy disabling, IP allowlist modification.
Repository made public, webhook to external URL, bulk code download.
Detection rules (20 of 42 shown)
Showing 20 representative rules. All 42 rules activate with one click.
| Rule name | Severity |
|---|---|
| GitHub Secret Scanning Alert — Exposed Credential | Critical |
| GitHub Actions Workflow Modified to Add External Exfiltration Step | Critical |
| GitHub Organisation Admin Role Granted to Unexpected User | Critical |
| GitHub Repository Made Public | High |
| GitHub Personal Access Token Created with Admin Scope | High |
| GitHub Deploy Key Added to Production Repository | High |
| GitHub Actions Secrets Accessed by Non-Owner Workflow | Critical |
| GitHub Branch Protection Disabled on Default Branch | High |
| GitHub SAML SSO Bypass — Non-SSO Authentication | High |
| GitHub Dependabot Alerts Disabled for Repository | Medium |
| GitHub Repository Deleted by Non-Owner | High |
| GitHub Actions Self-Hosted Runner Added to Organisation | High |
| GitHub Webhook Created with External URL | Medium |
| GitHub CodeQL Scanning Disabled for Repository | Medium |
| GitHub Outside Collaborator Added to Private Repository | High |
| GitHub Actions Workflow Runs with Write Permissions to Repository | Medium |
| GitHub Organisation Security Policy Disabled | High |
| GitHub Packages — Package Published from Unverified Source | High |
| GitHub Mass Repository Clone by Service Account | High |
| GitHub IP Allowlist Entry Added for Unexpected Range | Medium |
Prerequisites
- GitHub Enterprise Cloud organisation or GitHub Enterprise Server with audit log streaming enabled
- GitHub Advanced Security (GHAS) enabled for Secret Scanning and Code Scanning alert ingestion
- Audit log streaming configured to AWS S3, Azure Event Hub, or direct webhook to ManySignal
- GitHub App or PAT with read:audit_log, read:org, and security_events OAuth scopes
GitHub Detection Pack: frequently asked questions
What GitHub log sources does this detection pack use?
The GitHub detection pack uses GitHub Audit Log (organisation and enterprise level), GitHub Secret Scanning alerts, GitHub Advanced Security code scanning alerts, and Dependabot alerts. ManySignal connects via the GitHub Audit Log streaming API (webhook or Azure Event Hub / Amazon S3 streaming) or the REST API for organisations.
How does ManySignal detect supply chain attacks in GitHub Actions?
Supply chain detection in GitHub Actions focuses on workflow file modifications that introduce external dependencies (curl to external URLs, new third-party actions, exfiltration of GITHUB_TOKEN or repository secrets), self-hosted runner additions, and actions that run with excessive write permissions. ManySignal parses workflow YAML changes in audit events.
Does this pack cover GitHub Advanced Security (GHAS) alerts?
Yes. Secret Scanning alerts and Code Scanning (CodeQL) alerts are ingested and correlated with audit events. When a secret is exposed in a commit, ManySignal traces the committer's recent activity to determine if the exposure was accidental or intentional — for example, a user who disabled branch protection before pushing.
Can ManySignal detect insider source code theft from GitHub?
Yes. Mass repository clone by a service account or departing employee, bulk source code download via the API, and repository visibility changes are key insider threat signals. ManySignal correlates GitHub activity with HR system events (when integrated) to flag activity that coincides with resignation dates or disciplinary proceedings.
Does ManySignal support GitHub Enterprise Server (self-hosted)?
ManySignal supports GitHub Enterprise Cloud (github.com) and GitHub Enterprise Server (self-hosted). For GHES, audit log streaming must be configured to forward to an S3 bucket or Azure Blob Storage, which ManySignal then ingests. GHES audit log format is compatible with the cloud audit log schema.
Detect secrets exposure and supply chain attacks in GitHub
42 detection rules for GitHub — from Secret Scanning alerts to Actions workflow tampering and insider repository access.