GitHub OAuth App Access Restrictions Disabled

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when OAuth App access restrictions are disabled for a GitHub organization. With restrictions enabled, only
 11owner-approved OAuth Apps can access organization data; once disabled, any OAuth App that a member authorizes gains
 12access without owner review. Following an account takeover, an adversary may disable restrictions and then authorize a
 13malicious or attacker-controlled OAuth App to establish token-based persistence and exfiltrate repository data, making
 14this a high-impact change to the organization's third-party access controls.
 15"""
 16false_positives = [
 17    """
 18    Briefly disabling restrictions to onboard an approved vendor app. Re-enable immediately and approve that app
 19    explicitly instead when possible.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "GitHub OAuth App Access Restrictions Disabled"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating GitHub OAuth App Access Restrictions Disabled
 32
 33This rule triggers on `org.disable_oauth_app_restrictions`, which turns off the organization control that limits third-party OAuth App access to owner-approved apps. Once disabled, any OAuth App a member authorizes can access organization data without owner review. An adversary who has taken over an owner account commonly chains this with `oauth_authorization.create` to grant a malicious OAuth App broad, token-based access to repositories and organization resources, establishing persistence and a data-exfiltration path that survives password and session resets.
 34
 35### Possible investigation steps
 36
 37- Identify the actor from `user.name`, `github.actor_ip`, `github.user_agent`, and `github.programmatic_access_type`, and confirm whether they legitimately hold organization owner privileges.
 38- Determine whether the change was expected by checking change-management records and the affected `github.org`, and confirm whether OAuth App restrictions were previously enforced.
 39- Review OAuth authorization events (`oauth_authorization.create`) and third-party app grants created after the disable timestamp, prioritizing apps with broad scopes or unfamiliar publishers.
 40- Review authentication context for the actor around the event time for signs of takeover, such as sign-ins from new `github.actor_ip` addresses, unfamiliar user agents, or token-based access (`github.programmatic_access_type`) instead of normal interactive activity.
 41- Correlate for other high-impact identity or policy changes near the same timestamp, including owner or member additions, PAT grants, SSO/SAML changes, and 2FA requirement changes.
 42
 43### False positive analysis
 44
 45- An organization owner temporarily disables restrictions to onboard an approved vendor app; this should be ticketed and followed by re-enabling restrictions and explicitly approving the specific app instead.
 46- A planned governance or migration change performed by a known administrator can generate this event as expected activity.
 47
 48### Response and remediation
 49
 50- Re-enable OAuth App access restrictions for the organization as soon as the change is confirmed unauthorized, and approve required apps individually rather than leaving restrictions off.
 51- Review and revoke OAuth App authorizations granted after the disable event, especially apps with broad scopes or no business justification.
 52- Rotate credentials and tokens potentially exposed through authorized apps, including PATs, OAuth grants, and any secrets accessible to the granted apps.
 53- Review org audit logs for other changes made by the actor after the disable event, and revert any unauthorized modifications.
 54- Escalate to incident response if the actor is unknown or unauthorized, or if the disable event is followed by new OAuth grants, owner additions, or sign-ins from unfamiliar infrastructure.
 55- Harden by enforcing OAuth App access restrictions org-wide, restricting who can change organization security settings, and alerting on future changes to OAuth App restrictions and new third-party app authorizations.
 56"""
 57references = [
 58    "https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization",
 59]
 60risk_score = 73
 61rule_id = "d5f49e8c-8dad-41a0-a4ad-b9bf584fee3a"
 62severity = "high"
 63tags = [
 64    "Domain: Cloud",
 65    "Domain: SaaS",
 66    "Platform: GitHub",
 67    "Use Case: Threat Detection",
 68    "Tactic: Defense Evasion",
 69    "Data Source: Github",
 70    "Data Source: GitHub Audit Logs",
 71    "Rule Type: ES|QL",
 72    "Resources: Investigation Guide",
 73]
 74timestamp_override = "event.ingested"
 75type = "esql"
 76
 77query = '''
 78from logs-github.audit-* metadata _id, _index, _version
 79| where
 80  event.module == "github" and data_stream.dataset == "github.audit"
 81    and event.action == "org.disable_oauth_app_restrictions"
 82| keep
 83    _id,
 84    _index,
 85    _version,
 86    @timestamp,
 87    event.action,
 88    user.name,
 89    github.org,
 90    github.actor_ip,
 91    github.hashed_token,
 92    github.programmatic_access_type,
 93    github.user_agent
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1484"
101name = "Domain or Tenant Policy Modification"
102reference = "https://attack.mitre.org/techniques/T1484/"
103[[rule.threat.technique]]
104id = "T1562"
105name = "Impair Defenses"
106reference = "https://attack.mitre.org/techniques/T1562/"
107[[rule.threat.technique.subtechnique]]
108id = "T1562.001"
109name = "Disable or Modify Tools"
110reference = "https://attack.mitre.org/techniques/T1562/001/"
111
112[[rule.threat.technique]]
113id = "T1484"
114name = "Domain or Tenant Policy Modification"
115reference = "https://attack.mitre.org/techniques/T1484/"
116
117
118[rule.threat.tactic]
119id = "TA0005"
120name = "Defense Evasion"
121reference = "https://attack.mitre.org/tactics/TA0005/"
122
123[rule.investigation_fields]
124field_names = [
125    "@timestamp",
126    "event.action",
127    "user.name",
128    "github.org",
129    "github.actor_ip",
130    "github.hashed_token",
131    "github.programmatic_access_type",
132    "github.user_agent",
133]