How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

This is a solid playbook from the Wiz CIRT team based on a real-world campaign. If you manage CI/CD pipelines or have GitHub orgs with broad PAT scopes, this is required reading.

Technical Breakdown

• Attack Vector: Compromised GitHub Personal Access Tokens (PATs) with overly permissive scopes (e.g., repo, workflow). The initial compromise vector is not specified, but the post focuses on post-compromise detection.
• TTPs (MITRE):
  • TA0006 (Credential Access): Abuse of valid accounts (PATs).
  • TA0040 (Impact): Data exfiltration from private repos.
  • T1525 (Implant Internal Image): Malicious commits pushed to trigger supply chain attacks.
• Key IOCs to Hunt:
  • Unusual Git activity from unfamiliar IPs or geolocations.
  • PATs created or used outside of normal business hours.
  • Commits pushed directly to main or master branches bypassing PR review.
  • New GitHub Actions workflows or modified YAML files that pull external binaries or exfiltrate data.
  • Audit log entries for repo.access or org.pat events from unexpected users.

Defense & Detection

• Immediate Triage: Revoke the compromised PAT immediately. Audit all repos the token had access to for unauthorized changes (commits, branches, secrets).
• Detection: Enable GitHub Audit Log streaming to your SIEM. Alert on PAT creation events and repo.access events from non-corporate IPs.
• Mitigation: Enforce the principle of least privilege for PATs. Use fine-grained PATs scoped to specific repos and expirations. Mandate OIDC for cloud provider access instead of long-lived secrets.

Key Takeaway: A single over-privileged PAT can cascade into a multi-org supply chain incident. Treat PATs like crown jewels—audit them aggressively and enforce short lifespans.

Source: https://www.wiz.io/blog/investigating-github-pat-compromise