ATT&CK technique
View on MITRE ATT&CK →
T1567.001
Exfiltration to Code Repository
Exfiltration
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Connection to Commonly Abused Web Services | production | 2026-10-19 |
| elastic | GitHub Private Repository Turned Public | production | 2026-09-18 |
| elastic | GitHub Exfiltration via High Number of Repository Clones by User | production | 2026-09-18 |
| elastic | High Number of Closed Pull Requests by User | production | 2026-09-18 |
| elastic | Several Failed Protected Branch Force Pushes by User | production | 2026-09-18 |
| elastic | Unusual DNS Request to Suspicious Top Level Domain | production | 2026-09-18 |
| elastic | Potential PowerShell HackTool Script by Function Names | production | 2026-09-18 |
| elastic | High Number of Protected Branch Force Pushes by User | production | 2026-09-18 |
| sigma | GitHub Repository Pages Site Changed to Public | experimental | 2025-10-18 |
| sigma | Network Connection Initiated To DevTunnels Domain | test | 2023-11-20 |