GitHub OAuth App Restrictions Disabled

Description

'This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. '

Query · kql

GitHubAudit
| where Action == "org.disable_oauth_app_restrictions"
| project TimeGenerated, Action, Actor, Country
Raw source GitHub OAuth App Restrictions Disabled · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 667e6a70-adc9-49b7-9cf3-f21927c71959
name: GitHub OAuth App Restrictions Disabled
description: |
  'This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. '
requiredDataConnectors: []
tactics:
  - Persistence
  - DefenseEvasion
relevantTechniques:
  - T1505
  - T1562
query: |

  GitHubAudit
  | where Action == "org.disable_oauth_app_restrictions"
  | project TimeGenerated, Action, Actor, Country

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.