{"id":"T1213.003","name":"Code Repositories","url":"https://attack.mitre.org/techniques/T1213/003","tactics":["collection"],"platforms":["SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0263","stix_id":"x-mitre-detection-strategy--574968c5-ca49-4005-958f-c3ea5a78cfbc","name":"Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0263","analytics":[{"id":"AN0732","stix_id":"x-mitre-analytic--0aa20e10-ec46-4acf-810e-e8ed038d7744","name":"Analytic 0732","description":"Anomalous or bulk download activity from private or restricted repositories by non-developer or privileged accounts, often preceded by unusual login behavior (e.g., unfamiliar geo, OAuth token use, elevated API rate).","url":"https://attack.mitre.org/detectionstrategies/DET0263#AN0732","platforms":["SaaS"],"log_source_references":[{"name":"saas:github","channel":"repo.download, repo.clone, oauth.authorize, repo.getContent","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"saas-github"},{"name":"saas:github","channel":"Login from unusual IP, device fingerprint, or location; access token creation from new client","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"saas-github"},{"name":"saas:github","channel":"Bulk access to multiple files or large volume of repo requests within short time window","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-github"}],"mutable_elements":[{"field":"TimeWindow","description":"Threshold for file access volume over short duration (e.g., 10+ repos accessed in <5 min)"},{"field":"UserContext","description":"Role or permission profile expected to interact with repositories (e.g., developers vs. admins)"},{"field":"GeoAnomalyThreshold","description":"Distance or variance allowed before a login is flagged as anomalous"},{"field":"RepoSensitivityTag","description":"Whether a repository is labeled sensitive or restricted"}],"live":true,"detection_strategies":["DET0263"],"techniques":["T1213.003"]}],"live":true,"version":"1.0","techniques":["T1213.003"]}],"sigma_rules":[{"id":"16a71777-0b2e-4db7-9888-9d59cb75200b","title":"Github Delete Action Invoked","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2023-01-19","modified":"2026-03-09","description":"Detects delete action in the Github audit logs for codespaces, environment, project and repo.","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions","https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces"],"logsource":{"product":"github","service":"audit"},"tags":["attack.impact","attack.collection","attack.t1213.003"],"path":"rules/application/github/audit/github_delete_action_invoked.yml","techniques":["T1213.003"],"cves":[]},{"id":"195e1b9d-bfc2-4ffa-ab4e-35aef69815f8","title":"Bitbucket Full Data Export Triggered","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"high","date":"2024-02-25","modified":null,"description":"Detects when full data export is attempted.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.collection","attack.t1213.003"],"path":"rules/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml","techniques":["T1213.003"],"cves":[]},{"id":"34d81081-03c9-4a7f-91c9-5e46af625cde","title":"Bitbucket Unauthorized Full Data Export Triggered","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"critical","date":"2024-02-25","modified":null,"description":"Detects when full data export is attempted an unauthorized user.","references":["https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html","https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html"],"logsource":{"product":"bitbucket","service":"audit"},"tags":["attack.collection","attack.resource-development","attack.t1213.003","attack.t1586"],"path":"rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml","techniques":["T1213.003","T1586"],"cves":[]},{"id":"eaa9ac35-1730-441f-9587-25767bde99d7","title":"Github Outside Collaborator Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2023-01-20","modified":null,"description":"Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.\n","references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"],"logsource":{"product":"github","service":"audit"},"tags":["attack.privilege-escalation","attack.persistence","attack.collection","attack.t1098.001","attack.t1098.003","attack.t1213.003"],"path":"rules/application/github/audit/github_outside_collaborator_detected.yml","techniques":["T1098.001","T1098.003","T1213.003"],"cves":[]},{"id":"f8ed0e8f-7438-4b79-85eb-f358ef2fbebd","title":"Github Self Hosted Runner Changes Detected","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"low","date":"2023-01-27","modified":null,"description":"A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.\nThis rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,\nit should be validated from GitHub UI because the log entry may not provide full context.\n","references":["https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners","https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation"],"logsource":{"product":"github","service":"audit"},"tags":["attack.impact","attack.discovery","attack.collection","attack.persistence","attack.privilege-escalation","attack.initial-access","attack.stealth","attack.t1526","attack.t1213.003","attack.t1078.004"],"path":"rules/application/github/audit/github_self_hosted_runner_changes_detected.yml","techniques":["T1526","T1213.003","T1078.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}