GitHub large amount of classic personal access token use via suspicious VPN

github-telemetry

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects when a GitHub personal access token is used with a non-corporate VPN to access your GitHub instance. Identifies potential unauthorized access or token compromise through anomalous client behavior.

Strategy

This rule monitors GitHub audit logs for personal access token usage with a suspicious VPN. It tracks a high number of actions taken by a single user across unique repositories.

Triage & Response

  • Examine the ASN for {{@github.actor}} to determine if it represents legitimate automation or a suspicious client.
  • Verify if the token owner authorized the use of new tools or scripts that would generate different user agent strings.
  • Review recent GitHub activity for the user to identify any suspicious repository access or data collection attempts.