---
title: GitHub OAuth Application Authorized
description: Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until revoked and can clone or ZIP private...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/github/persistence_github_oauth_application_authorized
products:
  - Elastic Security
---

# GitHub OAuth Application Authorized
Detects when a user authorizes a GitHub OAuth application. Stolen OAuth grants persist after password changes until
revoked and can clone or ZIP private repositories. This is not a GitHub App installation
(integration_installation.create).
**Rule type**: esql
**Rule indices**:
**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/](https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/)](https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/)
- [[https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/](https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/)](https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/)
- [[https://github.blog/news-insights/company-news/security-alert-new-phishing-campaign-targets-github-users/](https://github.blog/news-insights/company-news/security-alert-new-phishing-campaign-targets-github-users/)](https://github.blog/news-insights/company-news/security-alert-new-phishing-campaign-targets-github-users/)
- [[https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps](https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps)](https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/authorizing-oauth-apps)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Domain: Identity
- Platform: GitHub
- Profile: Beta
- Use Case: Threat Detection
- Tactic: Credential Access
- Tactic: Persistence
- Threat: OAuth App Consent
- Data Source: Github
- Data Source: GitHub Audit Logs
- Rule Type: ESQL
- Resources: Investigation Guide

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating GitHub OAuth Application Authorized

`oauth_authorization.create` is a user grant of an OAuth App. It is distinct from installing a GitHub App. After a grant, look for `git.clone` or `repo.download_zip` with `programmatic_access_type` of OAuth access token.

### Possible investigation steps

- Identify `user.name`, `github.oauth_application_name` / `github.oauth_application_id`, `github.actor_ip`, and `github.user_agent`.
- Confirm the app is approved by the organization. Review requested scopes.
- Pivot to clone, ZIP, and `api.request` activity from the same user shortly after the grant.


### False positive analysis

- First-time login to an approved CI, IDE, or SaaS integration.


### Response and remediation

- If unauthorized, revoke the OAuth grant and the application's tokens, then force a password reset and session invalidation.
- Review org third-party application restrictions.


## Rule Query

```esql
from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "oauth_authorization.create"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.oauth_application_name,
    github.oauth_application_id,
    github.programmatic_access_type,
    github.user_agent,
    github.name
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Valid Accounts
  - Id: T1078
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)](https://attack.mitre.org/techniques/T1078/)
- Sub Technique:
  - Name: Cloud Accounts
  - Id: T1078.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/004/](https://attack.mitre.org/techniques/T1078/004/)](https://attack.mitre.org/techniques/T1078/004/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
  - Id: TA0006
  - Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)
- Technique:
  - Name: Steal Application Access Token
  - Id: T1528
  - Reference URL: [[https://attack.mitre.org/techniques/T1528/](https://attack.mitre.org/techniques/T1528/)](https://attack.mitre.org/techniques/T1528/)