Techniques
Sample rules
GitHub PAT Access Restriction Disabled
- source: elastic
- technicques:
- T1098
- T1484
- T1562
Description
Detects when the organization control that restricts personal access token (PAT) access to GitHub organization resources is disabled. With the restriction enabled, classic and fine-grained PATs cannot reach organization-owned resources; once disabled, any member’s PAT can access private repositories again without owner enforcement. Following an account takeover, an adversary may disable this restriction so that a leaked or attacker-created PAT regains access to organization data, establishing token-based persistence and a data-exfiltration path, making this a high-impact change to the organization’s programmatic-access controls.
Detection logic
from logs-github.audit-* metadata _id, _index, _version
| where
data_stream.dataset == "github.audit"
and event.action == "personal_access_token.access_restriction_disabled"
| keep
_id,
_index,
_version,
@timestamp,
event.action,
user.name,
github.org,
github.repo,
github.actor_ip,
github.hashed_token,
github.programmatic_access_type,
github.user_agent,
github.token_scopes