GitHub Fine-Grained PAT Auto-Approve Enabled

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub
 11organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can access
 12organization resources; once enabled, members' PAT requests gain access without that review, removing a key control
 13over programmatic access. Following an account takeover, an adversary with owner access may enable auto-approval to
 14quietly provision long-lived, organization-scoped tokens for persistence and data access, making this a high-impact
 15change to the organization's programmatic-access controls.
 16"""
 17false_positives = [
 18    """
 19    Organizations may enable fine-grained PAT auto-approval intentionally to streamline trusted internal token
 20    workflows. Confirm the change against a policy decision or change ticket, and scope exceptions by actor when the
 21    behavior is expected.
 22    """,
 23]
 24from = "now-9m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "GitHub Fine-Grained PAT Auto-Approve Enabled"
 28note = """## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating GitHub Fine-Grained PAT Auto-Approve Enabled
 34
 35`auto_approve_personal_access_token_requests.enable` turns on automatic approval of fine-grained personal access token (PAT) requests for an organization. Once enabled, members' fine-grained PAT requests gain access to organization resources without an owner reviewing and approving each request, removing a key control over programmatic access. Adversaries with owner access may enable this to quietly provision long-lived, organization-scoped tokens for persistence.
 36
 37This is a different control from the PAT *access restriction*. Disabling that restriction is `personal_access_token.access_restriction_disabled`, which is covered by a separate rule. Disabling auto-approval (`auto_approve_personal_access_token_requests.disable`) restores the owner-review requirement and is a hardening action, so it is intentionally not alerted here.
 38
 39### Possible investigation steps
 40
 41- Review `user.name`, `github.org`, and `github.actor_ip` to confirm whether an authorized organization owner made the change, and from an expected location and client.
 42- Determine whether the change aligns with a documented policy decision or change ticket; auto-approval is sometimes enabled intentionally to streamline trusted PAT workflows.
 43- List `personal_access_token.access_granted` events after the change to identify PATs that were auto-approved, and review their scopes and target repositories.
 44- Correlate with private `git.clone` / `git.push` and other programmatic activity performed by the newly granted tokens.
 45- Check for other recent control changes (owner additions, PAT access restriction disabled, MFA or OAuth App restriction changes) that may indicate a broader tampering campaign.
 46
 47### False positive analysis
 48
 49- Organizations may legitimately enable auto-approval to reduce administrative overhead for trusted internal fine-grained PAT workflows. Confirm the change is expected and, if so, scope exceptions by actor or correlate with a change ticket.
 50- Policy experiments in non-production organizations.
 51
 52### Response and remediation
 53
 54- If the change is unauthorized, disable auto-approval to restore the owner-review requirement.
 55- Review and revoke fine-grained PATs that were granted while auto-approval was enabled.
 56- Audit the resources and repositories accessed by those tokens and rotate any exposed secrets.
 57- Confirm the actor's account is not compromised and review their other recent administrative actions.
 58"""
 59references = [
 60    "https://github.blog/security/application-security/introducing-fine-grained-personal-access-tokens-for-github/",
 61    "https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization",
 62]
 63risk_score = 47
 64rule_id = "56fe656f-641f-412f-92d7-d450f992011f"
 65severity = "medium"
 66tags = [
 67    "Domain: Cloud",
 68    "Domain: SaaS",
 69    "Platform: GitHub",
 70    "Use Case: Threat Detection",
 71    "Tactic: Persistence",
 72    "Tactic: Defense Evasion",
 73    "Data Source: Github",
 74    "Data Source: GitHub Audit Logs",
 75    "Rule Type: ESQL",
 76    "Resources: Investigation Guide",
 77]
 78timestamp_override = "event.ingested"
 79type = "esql"
 80
 81query = '''
 82from logs-github.audit-* metadata _id, _index, _version
 83| where
 84  event.module == "github" and data_stream.dataset == "github.audit"
 85    and event.action == "auto_approve_personal_access_token_requests.enable"
 86| keep
 87    _id,
 88    _index,
 89    _version,
 90    @timestamp,
 91    event.action,
 92    user.name,
 93    github.org,
 94    github.repo,
 95    github.actor_ip,
 96    github.hashed_token,
 97    github.programmatic_access_type,
 98    github.user_agent
 99'''
100
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104[[rule.threat.technique]]
105id = "T1562"
106name = "Impair Defenses"
107reference = "https://attack.mitre.org/techniques/T1562/"
108
109[[rule.threat.technique]]
110id = "T1484"
111name = "Domain or Tenant Policy Modification"
112reference = "https://attack.mitre.org/techniques/T1484/"
113
114
115[rule.threat.tactic]
116id = "TA0005"
117name = "Defense Evasion"
118reference = "https://attack.mitre.org/tactics/TA0005/"
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1098"
123name = "Account Manipulation"
124reference = "https://attack.mitre.org/techniques/T1098/"
125[[rule.threat.technique.subtechnique]]
126id = "T1098.001"
127name = "Additional Cloud Credentials"
128reference = "https://attack.mitre.org/techniques/T1098/001/"
129
130
131[rule.threat.tactic]
132id = "TA0003"
133name = "Persistence"
134reference = "https://attack.mitre.org/tactics/TA0003/"
135
136[rule.investigation_fields]
137field_names = [
138    "@timestamp",
139    "event.action",
140    "user.name",
141    "github.org",
142    "github.repo",
143    "github.actor_ip",
144    "github.hashed_token",
145    "github.programmatic_access_type",
146    "github.user_agent",
147]