Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a GitHub personal access token is set to auto approve.

Strategy

This rule monitors GitHub audit logs for when a GitHub organization changes the auto approval policy on personal access tokens. Changes in personal access token (PAT) settings can be a sign of persistence from an actor that is generating PATs to maintain access to repositories.

Triage and response

1. Determine if the change taken by {{@github.actor}} is authorized.
2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.