GitHub Enterprise or Organization SSO Recovery Codes Activity

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•30

This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.