r_m_github_github_Malware.md

Rules by Product and UseCase

Vendor: GitHub

Product: GitHub

Use-Case: Malware

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
1	0	1	2	2

Event Type	Rules	Models
app-login	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP
authentication-successful	T1078 - Valid Accounts ↳ Auth-Blacklist-Shost: User authentication or login from a known blacklisted IP