GitHub activity from automated scraping tool

github-telemetry

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detects GitHub API requests from automated scraping tools that may be collecting sensitive repository data.

Strategy

This rule monitors GitHub audit logs for API requests containing common user agents from scraping tools. Automated scraping tools often use distinctive user agent strings and generate high-volume API requests that differ from normal user behavior patterns.

Triage & Response

  • Examine the GitHub API requests from {{@github.actor}} to determine the scope and nature of data being accessed.
  • Review the repositories, organizations, and resources targeted by the automated tool to assess potential data exposure risks.
  • Identify if the scraping activity is authorized by checking with repository owners and organization administrators.
  • Rotate the access keys involved in this behavior, if needed.