| Compromised Credentials | app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
authentication-successful
↳github-g-json-app-authentication-success-authorizationgrant
↳github-g-json-app-authentication-success-accessgranted
↳github-g-kv-app-authentication-success-gitauth
↳github-g-json-app-authentication-success-orgssoresponse
↳github-g-json-app-authentication-success-businessssoresponse
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
process-created
↳github-g-json-process-create-success-ssh_command
| T1003 - OS Credential Dumping
T1003.001 - T1003.001
T1003.002 - T1003.002
T1003.003 - T1003.003
T1003.005 - T1003.005
T1016 - System Network Configuration Discovery
T1040 - Network Sniffing
T1078 - Valid Accounts
T1133 - External Remote Services
T1190 - Exploit Public Fasing Application
T1218 - Signed Binary Proxy Execution
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1555 - Credentials from Password Stores
TA0002 - TA0002
| |
| Data Access | app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
process-created
↳github-g-json-process-create-success-ssh_command
| T1003 - OS Credential Dumping
T1078 - Valid Accounts
| |
| Data Leak | app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
| T1114 - Email Collection
T1114.003 - Email Collection: Email Forwarding Rule
| |
| Lateral Movement | app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
authentication-failed
↳github-g-json-app-authentication-fail-accessrevoked
↳github-g-json-app-authentication-fail-authorizationdeauthorize
authentication-successful
↳github-g-json-app-authentication-success-authorizationgrant
↳github-g-json-app-authentication-success-accessgranted
↳github-g-kv-app-authentication-success-gitauth
↳github-g-json-app-authentication-success-orgssoresponse
↳github-g-json-app-authentication-success-businessssoresponse
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
process-created
↳github-g-json-process-create-success-ssh_command
| T1021 - Remote Services
T1021.001 - Remote Services: Remote Desktop Protocol
T1021.003 - T1021.003
T1021.006 - T1021.006
T1047 - Windows Management Instrumentation
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1078 - Valid Accounts
T1090 - Proxy
T1090.003 - Proxy: Multi-hop Proxy
T1210 - Exploitation of Remote Services
T1219 - Remote Access Software
T1563 - Remote Service Session Hijacking
T1563.002 - T1563.002
| |
| Malware | app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
authentication-successful
↳github-g-json-app-authentication-success-authorizationgrant
↳github-g-json-app-authentication-success-accessgranted
↳github-g-kv-app-authentication-success-gitauth
↳github-g-json-app-authentication-success-orgssoresponse
↳github-g-json-app-authentication-success-businessssoresponse
process-created
↳github-g-json-process-create-success-ssh_command
| T1003 - OS Credential Dumping
T1003.002 - T1003.002
T1012 - Query Registry
T1021 - Remote Services
T1021.002 - Remote Services: SMB/Windows Admin Shares
T1027 - Obfuscated Files or Information
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1036 - Masquerading
T1036.004 - T1036.004
T1047 - Windows Management Instrumentation
T1053 - Scheduled Task/Job
T1053.003 - T1053.003
T1053.005 - Scheduled Task/Job: Scheduled Task
T1055 - Process Injection
T1055.001 - Process Injection: Dynamic-link Library Injection
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.003 - T1059.003
T1059.005 - T1059.005
T1059.007 - T1059.007
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1105 - Ingress Tool Transfer
T1112 - Modify Registry
T1113 - Screen Capture
T1123 - Audio Capture
T1127 - Trusted Developer Utilities Proxy Execution
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1134 - Access Token Manipulation
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1134.002 - T1134.002
T1135 - Network Share Discovery
T1190 - Exploit Public Fasing Application
T1197 - BITS Jobs
T1202 - Indirect Command Execution
T1203 - Exploitation for Client Execution
T1204 - User Execution
T1204.002 - T1204.002
T1210 - Exploitation of Remote Services
T1218 - Signed Binary Proxy Execution
T1218.001 - Signed Binary Proxy Execution: Compiled HTML File
T1218.002 - Signed Binary Proxy Execution: Control Panel
T1218.004 - Signed Binary Proxy Execution: InstallUtil
T1218.005 - T1218.005
T1218.007 - Signed Binary Proxy Execution: Msiexec
T1218.008 - T1218.008
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1482 - Domain Trust Discovery
T1490 - Inhibit System Recovery
T1505 - Server Software Component
T1505.003 - Server Software Component: Web Shell
T1543 - Create or Modify System Process
T1543.003 - Create or Modify System Process: Windows Service
T1546 - Event Triggered Execution
T1546.001 - T1546.001
T1546.003 - T1546.003
T1546.011 - T1546.011
T1547 - Boot or Logon Autostart Execution
T1547.001 - T1547.001
T1547.002 - T1547.002
T1550 - Use Alternate Authentication Material
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1555 - Credentials from Password Stores
T1558 - Steal or Forge Kerberos Tickets
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1562 - Impair Defenses
T1562.004 - Impair Defenses: Disable or Modify System Firewall
T1563 - Remote Service Session Hijacking
T1563.002 - T1563.002
T1569 - System Services
T1574 - Hijack Execution Flow
T1574.002 - Hijack Execution Flow: DLL Side-Loading
T1574.010 - T1574.010
T1574.011 - T1574.011
TA0002 - TA0002
| |
| Privilege Abuse | account-creation
↳github-g-json-app-activity-document_id
app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
app-activity-failed
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
member-removed
↳github-g-json-group-member-remove-success-teamremovemember
process-created
↳github-g-json-process-create-success-ssh_command
| T1047 - Windows Management Instrumentation
T1078 - Valid Accounts
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1136 - Create Account
T1136.001 - Create Account: Create: Local Account
T1136.002 - T1136.002
| |
| Privilege Escalation | app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
process-created
↳github-g-json-process-create-success-ssh_command
| T1003 - OS Credential Dumping
T1007 - System Service Discovery
T1012 - Query Registry
T1016 - System Network Configuration Discovery
T1018 - Remote System Discovery
T1027 - Obfuscated Files or Information
T1027.004 - Obfuscated Files or Information: Compile After Delivery
T1033 - System Owner/User Discovery
T1036 - Masquerading
T1036.004 - T1036.004
T1047 - Windows Management Instrumentation
T1049 - System Network Connections Discovery
T1053 - Scheduled Task/Job
T1053.002 - Scheduled Task/Job: At (Windows)
T1053.005 - Scheduled Task/Job: Scheduled Task
T1057 - Process Discovery
T1059 - Command and Scripting Interperter
T1059.001 - Command and Scripting Interperter: PowerShell
T1059.003 - T1059.003
T1068 - Exploitation for Privilege Escalation
T1082 - System Information Discovery
T1087 - Account Discovery
T1087.001 - Account Discovery: Local Account
T1087.002 - Account Discovery: Domain Account
T1098 - Account Manipulation
T1098.002 - Account Manipulation: Exchange Email Delegate Permissions
T1127 - Trusted Developer Utilities Proxy Execution
T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild
T1134 - Access Token Manipulation
T1134.001 - Access Token Manipulation: Token Impersonation/Theft
T1134.002 - T1134.002
T1135 - Network Share Discovery
T1218 - Signed Binary Proxy Execution
T1218.002 - Signed Binary Proxy Execution: Control Panel
T1218.003 - Signed Binary Proxy Execution: CMSTP
T1218.010 - Signed Binary Proxy Execution: Regsvr32
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1222 - File and Directory Permissions Modification
T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
T1482 - Domain Trust Discovery
T1484 - Group Policy Modification
T1484.001 - T1484.001
T1518 - Software Discovery
T1518.001 - T1518.001
T1543 - Create or Modify System Process
T1543.003 - Create or Modify System Process: Windows Service
T1547 - Boot or Logon Autostart Execution
T1547.002 - T1547.002
T1548 - Abuse Elevation Control Mechanism
T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
T1552 - Unsecured Credentials
T1552.006 - T1552.006
T1558 - Steal or Forge Kerberos Tickets
T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
T1574 - Hijack Execution Flow
T1574.002 - Hijack Execution Flow: DLL Side-Loading
T1574.011 - T1574.011
| |
| Privileged Activity | app-activity
↳github-g-json-app-activity-success-actorid
↳github-g-json-app-activity-success-pullrequestreviewcommentcreate
↳github-g-json-app-activity-success-preparedworkflowjob
↳github-g-json-app-activity-success-secretscanningpushprotectionbypass
↳github-g-json-app-activity-success-pullrequestcreatereviewrequest
↳github-g-json-app-activity-success-secretscanningalert
↳github-g-json-app-activity-success-workflowscompletedworkflowrun
↳github-g-json-app-activity-success-githubaudit
↳github-g-json-app-activity-success-workflowscreatedworkflowrun
↳github-g-json-app-activity-success-code_scanning
↳github-g-kv-app-activity-success-githubunicorn
↳github-g-json-app-activity-success-apirequest
↳github-g-json-app-activity-success-integrationinstallation
↳github-g-json-app-activity-success-pullrequestreviewsubmit
↳github-g-json-app-activity-success-issuecommentupdate
↳github-g-json-configuration-create-success-environmentcreate
↳github-g-json-hook-delete-success-hookdestroy
↳github-g-json-hook-modify-success-hookconfigchanged
↳github-g-json-branch-protection-enable-success-protectedbranchcreate
↳github-g-json-branch-protection-disable-success-protectedbranchdestroy
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-invitemember
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-user-invite-success-org
↳github-g-json-http-request-success-githubaudithook
↳github-g-json-repository-create-success-gitclone
↳github-g-sk4-repository-create-success-createevent
↳github-g-json-repository-create-success-githubauditrepo
↳github-g-csv-repository-create-success-projectcreate
↳github-g-csv-repository-modify-success-update
↳github-g-json-user-create-success-githubauditteam
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-document_id
↳github-g-json-app-activity-success-pullrequest
↳github-g-json-app-activity-success-team
↳github-g-json-app-activity-success-issuecommentdestroy
↳github-g-sk4-repository-create-success-github
↳github-g-json-app-activity-success-workflows
↳github-g-json-app-activity-success-org
↳github-g-json-branch-modify-success-pullrequestmerge
↳github-g-json-branch-modify-success-pullrequestindirectmerge
↳github-g-json-repository-push-success-gitpush
↳github-g-sk4-repository-push-success-pushevent
↳github-g-json-repository-pull-success-gitfetch
↳github-g-sk4-repository-pull-success-pullrequestevent
↳github-g-json-repository-pull-success-repodownloadzip
↳github-g-json-branch-create-success-pullrequestcreate
↳github-g-sk4-repository-member-add-success-memberevent
↳github-g-json-repository-member-add-success-teamaddmember
↳github-g-sk4-repository-delete-success-deleteevent
↳github-g-json-hook-create-success-repocreate
↳github-g-json-repository-create-success-repocreate
↳github-g-json-key-read-success-publickeyverify
↳github-g-json-key-create-success-publickeycreate
↳github-g-json-key-delete-success-publickeydelete
↳github-g-json-branch-protection-modify-success-policyoverride
↳github-g-json-branch-protection-modify-success-protectedbranchupdateadminenforced
↳github-g-json-branch-protection-modify-success-protectedbranchupdate
↳github-g-json-app-activity-success-action
↳github-g-json-repository-modify-success-repo
↳github-g-json-repository-modify-success-repo
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
↳github-g-json-app-activity-success-action
app-activity-failed
↳github-g-kv-app-activity-controller
↳github-g-json-app-activity-success-namespaceid
↳github-g-kv-http-request-api
↳github-g-kv-http-request-githubunicorn
app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
process-created
↳github-g-json-process-create-success-ssh_command
| T1078 - Valid Accounts
T1482 - Domain Trust Discovery
| |
| Ransomware | app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-activity-document_id
↳github-g-json-app-login-success-user_sign_in
authentication-failed
↳github-g-json-app-authentication-fail-accessrevoked
↳github-g-json-app-authentication-fail-authorizationdeauthorize
authentication-successful
↳github-g-json-app-authentication-success-authorizationgrant
↳github-g-json-app-authentication-success-accessgranted
↳github-g-kv-app-authentication-success-gitauth
↳github-g-json-app-authentication-success-orgssoresponse
↳github-g-json-app-authentication-success-businessssoresponse
failed-app-login
↳github-g-kv-app-login-authentication
↳github-g-json-app-login-fail-failedlogin
process-created
↳github-g-json-process-create-success-ssh_command
| T1003 - OS Credential Dumping
T1003.001 - T1003.001
T1059 - Command and Scripting Interperter
T1059.003 - T1059.003
T1070 - Indicator Removal on Host
T1070.001 - Indicator Removal on Host: Clear Windows Event Logs
T1078 - Valid Accounts
T1218 - Signed Binary Proxy Execution
T1218.011 - Signed Binary Proxy Execution: Rundll32
T1222 - File and Directory Permissions Modification
T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification
T1486 - Data Encrypted for Impact
T1490 - Inhibit System Recovery
| |