LoFP / organizations may enable fine-grained pat auto-approval intentionally to streamline trusted internal token workflows. confirm the change against a policy decision or change ticket, and scope exceptions by actor when the behavior is expected.

Techniques

• T1098
• T1484
• T1562

Sample rules

GitHub Fine-Grained PAT Auto-Approve Enabled

• source: elastic
• technicques:
  • T1098
  • T1484
  • T1562

Description

Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can access organization resources; once enabled, members’ PAT requests gain access without that review, removing a key control over programmatic access. Following an account takeover, an adversary with owner access may enable auto-approval to quietly provision long-lived, organization-scoped tokens for persistence and data access, making this a high-impact change to the organization’s programmatic-access controls.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "auto_approve_personal_access_token_requests.enable"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent