Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a GitHub personal access token is used with a non-corporate VPN to access your GitHub instance. Identifies potential unauthorized access or token compromise through anomalous client behavior.

Strategy

This rule monitors GitHub audit logs for personal access token usage with a suspicious VPN. It tracks a high number of actions taken by a single user across unique repositories.

Triage & Response

• Examine the ASN for {{@github.actor}} to determine if it represents legitimate automation or a suspicious client.
• Verify if the token owner authorized the use of new tools or scripts that would generate different user agent strings.
• Review recent GitHub activity for the user to identify any suspicious repository access or data collection attempts.