01
detectionlint / library / yara-l
github_access_granted_to_personal_access_token_followed_by_high_number_of_cloned_non_public_repositories
Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.