Mapping out your unknown: A threat hunter’s guide to GitHub
Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.
Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.
- Attack chains follow Initial Access, Discovery, Credential Access, and Collection tactics within GitHub organizations.
- Device code phishing tricks victims into authorizing attacker-generated codes against real GitHub prompts.
- Queries detect logins from new devices or geolocation and new OAuth app authorizations.
- Leaked tokens in scripts, .env files, or infostealer-compromised laptops are a common entry path.
- ATT&CK
- T1078 Valid AccountsT1528 Steal Application Access TokenT1110.004 Credential StuffingT1552.001 Credentials In FilesT1213 Data from Information Repositories
- Vendors
- Datadog
- Products
- GitHub
- Malware
- infostealer
From the original article
13 min read at securitylabs.datadoghq.com
In this post, we walk through different threats to GitHub and how to detect them.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.