GitHub Fine-Grained PAT Auto-Approve Enabled
Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can…
Description
Detects when automatic approval of fine-grained personal access token (PAT) requests is enabled for a GitHub organization. With auto-approval off, an owner must review and approve each fine-grained PAT before it can access organization resources; once enabled, members' PAT requests gain access without that review, removing a key control over programmatic access. Following an account takeover, an adversary with owner access may enable auto-approval to quietly provision long-lived, organization-scoped tokens for persistence and data access, making this a high-impact change to the organization's programmatic-access controls.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Known benign triggers
- Organizations may enable fine-grained PAT auto-approval intentionally to streamline trusted internal token workflows. Confirm the change against a policy decision or change ticket, and scope exceptions by actor when the behavior is expected.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization | 2 |
| github.blog/security/application-security/introducing-fine-grained-personal-access-tokens-for-github/ | 2 |
From the source
- At source
- Open at source
- Upstream identifier
- 56fe656f-641f-412f-92d7-d450f992011f
- Tagged by the source as
- Data Source: GithubData Source: GitHub Audit LogsDomain: CloudDomain: SaaSPlatform: GitHubResources: Investigation GuideRule Type: ESQLTactic: Defense EvasionTactic: PersistenceUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Nov 4, 2026
- Version
- 1