LoFP / legitimate publishing of repository pages by authorized users

Techniques

• t1567
• t1567.001

Sample rules

GitHub Repository Pages Site Changed to Public

• source: sigma
• technicques:
  • t1567
  • t1567.001

Description

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

Detection logic

condition: selection
selection:
  action: repo.pages_public