GitHub PAT Access Followed by High Volume Non-Public Repository Clones
Detects when a user grants access to a GitHub Personal Access Token (PAT) and subsequently clones a high number of non-public GitHub repositories. This behavior can indicate an adversary attempting to steal the contents of multiple GitHub repositories using an automated script or offensive tool after gaining access to a PAT.
YARA-L
