LoFP LoFP / briefly disabling restrictions to onboard an approved vendor app. re-enable immediately and approve that app explicitly instead when possible.

Techniques

Sample rules

GitHub OAuth App Access Restrictions Disabled

Description

Detects when OAuth App access restrictions are disabled for a GitHub organization. With restrictions enabled, only owner-approved OAuth Apps can access organization data; once disabled, any OAuth App that a member authorizes gains access without owner review. Following an account takeover, an adversary may disable restrictions and then authorize a malicious or attacker-controlled OAuth App to establish token-based persistence and exfiltrate repository data, making this a high-impact change to the organization’s third-party access controls.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "org.disable_oauth_app_restrictions"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent