Techniques
Sample rules
GitHub SSO Recovery Codes Activity
- source: elastic
- technicques:
- T1078
- T1552
Description
Detects viewing, downloading, printing, generating, or using GitHub enterprise or organization SSO recovery codes. These codes bypass the IdP and are break-glass credentials.
Detection logic
from logs-github.audit-* metadata _id, _index, _version
| where
event.module == "github" and data_stream.dataset == "github.audit"
and event.action in (
"business.recovery_codes_downloaded",
"business.recovery_codes_generated",
"business.recovery_codes_printed",
"business.recovery_codes_viewed",
"business.recovery_code_used",
"business.recovery_code_failed",
"org.recovery_codes_downloaded",
"org.recovery_codes_generated",
"org.recovery_codes_printed",
"org.recovery_codes_viewed",
"org.recovery_code_used",
"org.recovery_code_failed"
)
| keep
_id,
_index,
_version,
@timestamp,
event.action,
user.name,
github.org,
github.actor_is_bot,
github.repo,
github.actor_ip,
github.hashed_token,
github.programmatic_access_type,
github.user_agent,
github.business