Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when GitHub personal access tokens are used to add collaborators to repositories or organizations.

Strategy

This rule monitors GitHub audit logs for adding collaborators executed through personal access tokens. It tracks two distinct scenarios:

• Repository collaborator additions via API calls to /repositories/:repository_id/collaborators/:username with PUT method.
• External collaborator additions to organizations through org.add_outside_collaborator actions.

Triage & Response

• Examine the {{@hashed_token}} to identify the personal access token responsible for the collaborator addition and trace its usage patterns.
• Verify if the token owner has legitimate authorization to add collaborators to the affected repository or organization.
• Review the added collaborator’s identity and determine if they are an expected team member or external party with business justification.
• Check the repository or organization’s access policies to confirm the collaborator addition aligns with established security controls.
• Analyze the timing and frequency of collaborator additions to identify potential bulk operations or suspicious automation patterns.