GitHub OAuth access token compromise
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when an OAuth access token is used from multiple autonomous system numbers (ASNs) and multiple user agents.
Strategy
This rule monitors GitHub audit logs for anomalous activity related to usage of an OAuth access token. By looking at ASNs and user agents, it profiles the expected use of that OAuth token and alerts when the activity deviates from more than two ASNs or two user agents per user in the defined threshold.
Triage and response
- Determine if the behavior is unusual for the user:
- Is the
{{@network.client.geoip.as.name}} different than expected? And the {{@user_agent}}? - Speak with the user to verify if the OAuth access token behavior is expected.
- If the activity is suspicious:
Changelog
- 25 November 2024 - Updated to exclude common public cloud providers.
- 29 July 2025 - Updated to group by ASN domain rather than ASN name, only alert when domain information is present, and filter out use of known corporate VPNs.
