2_ds_github_github.md

Use-Case	Activity Type (Legacy Event Type)/Parsers	MITRE ATT&CK® TTP	Content
Compromised Credentials	scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in endpoint-login:success (authentication-successful) ↳github-g-json-app-authentication-success-authorizationgrant ↳github-g-json-app-authentication-success-accessgranted ↳github-g-kv-app-authentication-success-gitauth ↳github-g-json-app-authentication-success-orgssoresponse ↳github-g-json-app-authentication-success-businessssoresponse app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1040 - Network Sniffing T1078 - Valid Accounts T1133 - External Remote Services T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1555 - Credentials from Password Stores TA0002 - TA0002	72 Rules 29 Models
Data Access	scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1003 - OS Credential Dumping T1078 - Valid Accounts	21 Rules 11 Models
Data Leak	scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo	T1114 - Email Collection T1114.003 - Email Collection: Email Forwarding Rule	3 Rules
Lateral Movement	app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in endpoint-login:fail (authentication-failed) ↳github-g-json-app-authentication-fail-authorizationdeauthorize endpoint-login:success (authentication-successful) ↳github-g-json-app-authentication-success-authorizationgrant ↳github-g-json-app-authentication-success-accessgranted ↳github-g-kv-app-authentication-success-gitauth ↳github-g-json-app-authentication-success-orgssoresponse ↳github-g-json-app-authentication-success-businessssoresponse app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1021.003 - T1021.003 T1021.006 - T1021.006 T1047 - Windows Management Instrumentation T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy T1210 - Exploitation of Remote Services T1219 - Remote Access Software T1563 - Remote Service Session Hijacking T1563.002 - T1563.002	24 Rules 1 Models
Malware	app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in endpoint-login:success (authentication-successful) ↳github-g-json-app-authentication-success-authorizationgrant ↳github-g-json-app-authentication-success-accessgranted ↳github-g-kv-app-authentication-success-gitauth ↳github-g-json-app-authentication-success-orgssoresponse ↳github-g-json-app-authentication-success-businessssoresponse process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1021.002 - Remote Services: SMB/Windows Admin Shares T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.004 - T1036.004 T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.003 - T1053.003 T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1055.001 - Process Injection: Dynamic-link Library Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1059.005 - T1059.005 T1059.007 - T1059.007 T1078 - Valid Accounts T1083 - File and Directory Discovery T1105 - Ingress Tool Transfer T1112 - Modify Registry T1113 - Screen Capture T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134 - Access Token Manipulation T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1134.002 - T1134.002 T1135 - Network Share Discovery T1190 - Exploit Public Fasing Application T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1204.002 - T1204.002 T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.001 - Signed Binary Proxy Execution: Compiled HTML File T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.004 - Signed Binary Proxy Execution: InstallUtil T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.008 - T1218.008 T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1482 - Domain Trust Discovery T1490 - Inhibit System Recovery T1505 - Server Software Component T1505.003 - Server Software Component: Web Shell T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service T1546 - Event Triggered Execution T1546.001 - T1546.001 T1546.003 - T1546.003 T1546.011 - T1546.011 T1547 - Boot or Logon Autostart Execution T1547.001 - T1547.001 T1547.002 - T1547.002 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1562 - Impair Defenses T1562.004 - Impair Defenses: Disable or Modify System Firewall T1563 - Remote Service Session Hijacking T1563.002 - T1563.002 T1569 - System Services T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011 TA0002 - TA0002	164 Rules 25 Models
Privilege Abuse	user-create:success (account-creation) ↳github-g-json-app-activity-document_id scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo app-activity:fail (app-activity-failed) ↳github-g-kv-app-activity-controller ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin group-member-remove:success (member-removed) ↳github-g-json-group-member-remove-success-teamremovemember process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1136.002 - T1136.002	47 Rules 21 Models
Privilege Escalation	scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1003 - OS Credential Dumping T1007 - System Service Discovery T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1033 - System Owner/User Discovery T1036 - Masquerading T1036.004 - T1036.004 T1047 - Windows Management Instrumentation T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.002 - Scheduled Task/Job: At (Windows) T1053.005 - Scheduled Task/Job: Scheduled Task T1057 - Process Discovery T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1068 - Exploitation for Privilege Escalation T1082 - System Information Discovery T1087 - Account Discovery T1087.001 - Account Discovery: Local Account T1087.002 - Account Discovery: Domain Account T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134 - Access Token Manipulation T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1134.002 - T1134.002 T1135 - Network Share Discovery T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.003 - Signed Binary Proxy Execution: CMSTP T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1222 - File and Directory Permissions Modification T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1482 - Domain Trust Discovery T1484 - Group Policy Modification T1484.001 - T1484.001 T1518 - Software Discovery T1518.001 - T1518.001 T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service T1547 - Boot or Logon Autostart Execution T1547.002 - T1547.002 T1548 - Abuse Elevation Control Mechanism T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control T1552 - Unsecured Credentials T1552.006 - T1552.006 T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.011 - T1574.011	47 Rules 7 Models
Privileged Activity	scheduled_task-trigger:success (app-activity) ↳github-g-json-app-activity-success-actorid ↳github-g-json-app-activity-success-pullrequestreviewcommentcreate ↳github-g-json-app-activity-success-preparedworkflowjob ↳github-g-json-app-activity-success-pullrequestcreatereviewrequest ↳github-g-json-app-activity-success-secretscanningalert ↳github-g-json-app-activity-success-workflowscompletedworkflowrun ↳github-g-json-app-activity-success-githubaudit ↳github-g-json-app-activity-success-workflowscreatedworkflowrun ↳github-g-json-app-activity-success-code_scanning ↳github-g-kv-app-activity-success-githubunicorn ↳github-g-json-app-activity-success-apirequest ↳github-g-json-app-activity-success-integrationinstallation ↳github-g-json-app-activity-success-pullrequestreviewsubmit ↳github-g-json-app-activity-success-issuecommentupdate ↳github-g-json-configuration-create-success-environmentcreate ↳github-g-json-hook-delete-success-hookdestroy ↳github-g-json-hook-modify-success-hookconfigchanged ↳github-g-json-branch-protection-enable-success-protectedbranchcreate ↳github-g-json-branch-protection-disable-success-protectedbranchdestroy ↳github-g-json-user-invite-success-org ↳github-g-json-http-request-success-githubaudithook ↳github-g-json-repository-create-success-gitclone ↳github-g-sk4-repository-create-success-createevent ↳github-g-json-repository-create-success-githubauditrepo ↳github-g-csv-repository-create-success-projectcreate ↳github-g-csv-repository-modify-success-update ↳github-g-json-user-create-success-githubauditteam ↳github-g-kv-app-activity-controller ↳github-g-json-app-activity-success-namespaceid ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-document_id ↳github-g-json-app-activity-success-pullrequest ↳github-g-json-app-activity-success-issuecommentdestroy ↳github-g-sk4-repository-create-success-github ↳github-g-json-app-activity-success-workflows ↳github-g-json-app-activity-success-team ↳github-g-json-app-activity-success-org ↳github-g-json-branch-modify-success-pullrequestmerge ↳github-g-json-branch-modify-success-pullrequestindirectmerge ↳github-g-json-repository-push-success-gitpush ↳github-g-sk4-repository-push-success-pushevent ↳github-g-json-repository-pull-success-gitfetch ↳github-g-sk4-repository-pull-success-pullrequestevent ↳github-g-json-repository-pull-success-repodownloadzip ↳github-g-json-branch-create-success-pullrequestcreate ↳github-g-sk4-repository-member-add-success-memberevent ↳github-g-json-repository-member-add-success-teamaddmember ↳github-g-sk4-repository-delete-success-deleteevent ↳github-g-json-hook-create-success-repocreate ↳github-g-json-repository-create-success-repocreate ↳github-g-json-key-read-success-publickeyverify ↳github-g-json-key-create-success-publickeycreate ↳github-g-json-key-delete-success-publickeydelete ↳github-g-json-branch-protection-modify-success-policyoverride ↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced ↳github-g-json-branch-protection-modify-success-protectedbranchupdate ↳github-g-json-repository-modify-success-repo ↳github-g-json-repository-modify-success-repo app-activity:fail (app-activity-failed) ↳github-g-kv-app-activity-controller ↳github-g-kv-http-request-api ↳github-g-kv-http-request-githubunicorn app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1078 - Valid Accounts T1482 - Domain Trust Discovery	3 Rules 1 Models
Ransomware	app-login:success (app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-activity-document_id ↳github-g-json-app-login-success-user_sign_in endpoint-login:fail (authentication-failed) ↳github-g-json-app-authentication-fail-authorizationdeauthorize endpoint-login:success (authentication-successful) ↳github-g-json-app-authentication-success-authorizationgrant ↳github-g-json-app-authentication-success-accessgranted ↳github-g-kv-app-authentication-success-gitauth ↳github-g-json-app-authentication-success-orgssoresponse ↳github-g-json-app-authentication-success-businessssoresponse app-login:fail (failed-app-login) ↳github-g-kv-app-login-authentication ↳github-g-json-app-login-fail-failedlogin process-create:success (process-created) ↳github-g-json-process-create-success-ssh_command	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1059 - Command and Scripting Interperter T1059.003 - T1059.003 T1070 - Indicator Removal on Host T1070.001 - Indicator Removal on Host: Clear Windows Event Logs T1078 - Valid Accounts T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1222 - File and Directory Permissions Modification T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1486 - Data Encrypted for Impact T1490 - Inhibit System Recovery	5 Rules