GitHub Personal Access Token created by suspicious IP

Docs > Plateforme de sécurité Datadog > OOTB Rules > GitHub Personal Access Token created by suspicious IP

Classification:

attack

Tactic:

Technique:

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect when a Personal Access Token (PAT) has been created from a suspicious IP.

Strategy

This rule monitors GitHub audit logs for when a PAT has been created from a suspicious IP. A phishing campaign reported by Github’s security team indicated that attackers may try to create a PAT once they have gained unauthorized access to an account to maintain access. Using Datadog threat intelligence the signals raised will have originated from IP addresses deemed to be suspicious.

Note: By default GitHub does not display the source IP address for events in your organization’s audit log. See this post for further information.

Triage and response

Determine if the behavior is unusual for the user:
- Is the @actor_location.country_code or @http.useragent different?
- If IP addresses are available, is the @network.client.ip or @network.client.geoip.as.domain different than usual?
- Speak with the user to verify if they added the PAT.
If the activity is suspicious:
- Block the user in GitHub to prevent further access.
- Begin your organization’s incident response process and investigate.