High Number of Cloned GitHub Repos From PAT

Last updated 12 days ago on 2024-12-10

Created a year ago on 2023-10-11

About

Detects a high number of unique private repo clone events originating from a single personal access token within a short time period.

Tags

Domain: CloudUse Case: Threat DetectionUse Case: UEBATactic: ExecutionData Source: Github

Severity

low

Risk Score

MITRE ATT&CK™

Execution (TA0002)(opens in a new tab or window)

↳ Serverless Execution (T1648)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type: Threshold Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-github.audit-*
Related Integrations: github(opens in a new tab or window)
Query

event.dataset:"github.audit" and event.category:"configuration" and event.action:"git.clone" and
github.programmatic_access_type:("OAuth access token" or "Fine-grained personal access token") and
github.repository_public:false

Install detection rules in Elastic Security

Detect High Number of Cloned GitHub Repos From PAT in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).