Elastic low stable eql

New GitHub Personal Access Token (PAT) Added

Detects when a new GitHub Personal Access Token (PAT) is created. Adversaries may create new PATs to maintain persistent access to a compromised account or to escalate privileges within an organization.

View Source

Detection Logic

configuration where data_stream.dataset == "github.audit" and github.operation_type == "create" and
github.category == "personal_access_token" and event.action == "personal_access_token.access_granted"

Field Validations

Loading…

Comments (0)

Loading comments...