Detection: MCP Github Suspicious Operation

 1`mcp_server` direction=inbound
 2
 3| eval dest=host
 4
 5| eval 
 6    query_lower=lower('params.query'),
 7    file_path_lower=lower('params.path'),
 8    search_query='params.query',
 9    file_path='params.path',
10    target_owner='params.owner',
11    is_secret_hunting=if(method="search_code" AND (like(query_lower, "%password%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%") OR like(query_lower, "%token%") OR like(query_lower, "%aws_%") OR like(query_lower, "%private_key%") OR like(query_lower, "%credential%") OR like(query_lower, "%.env%") OR like(query_lower, "%config%")), 1, 0),
12    is_org_recon=if(method IN ("list_repositories", "get_repository", "get_organization", "list_organization_members", "get_collaborators", "list_forks", "fork_repository"), 1, 0),
13    is_branch_protection_abuse=if(method IN ("update_branch_protection", "delete_branch_protection"), 1, 0),
14    is_workflow_manipulation=if((method IN ("create_or_update_file", "push_files")) AND like(file_path_lower, "%github/workflows%"), 1, 0),
15    is_sensitive_file_access=if((method IN ("create_or_update_file", "push_files", "get_file_contents")) AND (like(file_path_lower, "%dockerfile%") OR like(file_path_lower, "%package.json%") OR like(file_path_lower, "%requirements.txt%") OR like(file_path_lower, "%.env%") OR like(file_path_lower, "%settings.py%") OR like(file_path_lower, "%config%")), 1, 0),
16    is_issue_intel=if(method IN ("list_issues", "search_issues") AND (like(query_lower, "%vulnerability%") OR like(query_lower, "%cve%") OR like(query_lower, "%security%") OR like(query_lower, "%exploit%") OR like(query_lower, "%bug%")), 1, 0)
17
18| where is_secret_hunting=1 OR is_org_recon=1 OR is_branch_protection_abuse=1 OR is_workflow_manipulation=1 OR is_sensitive_file_access=1 OR is_issue_intel=1
19
20| eval attack_type=case(
21    is_secret_hunting=1, "Secret Hunting",
22    is_branch_protection_abuse=1, "Branch Protection Abuse",
23    is_workflow_manipulation=1, "Workflow Manipulation",
24    is_sensitive_file_access=1, "Sensitive File Access",
25    is_issue_intel=1, "Vulnerability Intelligence Gathering",
26    is_org_recon=1, "Organization Reconnaissance",
27    1=1, "Unknown")
28
29| stats count min(_time) as firstTime max(_time) as lastTime values(method) as methods values(search_query) as search_queries values(file_path) as file_paths values(target_owner) as target_owners values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
30
31| `security_content_ctime(firstTime)` 
32
33| `security_content_ctime(lastTime)`
34
35| table dest firstTime lastTime count attack_diversity attack_types methods search_queries file_paths target_owners
36
37| `mcp_github_suspicious_operation_filter`