Elastic Security Detection Rules

First Occurrence GitHub Event for a Personal Access Token (PAT)

Last updated 6 months ago on 2026-03-24

Created 3 years ago on 2023-10-11

About

Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.

Tags

Domain: CloudUse Case: Threat DetectionUse Case: UEBATactic: ExecutionRule Type: BBRData Source: GithubLanguage: kuery

Severity

low

Risk Score

21

MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

↳ Serverless Execution (T1648)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(external, opens in a new tab or window)

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-github.audit-*
Related Integrations: github(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset:"github.audit" and event.category:"configuration" and
event.action:* and github.hashed_token:* and 
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token")

Install detection rules in Elastic Security

Detect First Occurrence GitHub Event for a Personal Access Token (PAT) in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).