[New Rule] GitHub OAuth Application Authorized

[bryans3c]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/1121

Summary - What I changed

Added persistence_github_oauth_application_authorized, an ES|QL rule for oauth_authorization.create. Severity is low (Login-with-GitHub is routine). On non-EMU GHEC this user-security-log action often does not stream to enterprise audit.

Why it matters

Authorizing an OAuth app grants a token that can clone and ZIP private repos (Heroku/Travis 2022). The audit action is also everyday developer behavior, so severity is low. EMU is required for reliable enterprise-stream coverage.

• https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/
• https://github.blog/news-insights/company-news/security-alert-stolen-oauth-user-tokens/
• https://github.blog/news-insights/company-news/security-alert-new-phishing-campaign-targets-github-users/

How To Test

Authorize a lab OAuth App (localhost callback is expected). On non-EMU, check the user security log; enterprise logs-github.audit-* may not contain oauth_authorization.create.

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "oauth_authorization.create"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.name

Checklist

• Added a label for the type of pr: Rule: New
• query is inclusive, not overly exclusive
• name and description are descriptive and free of typos
• Secret and sensitive material has been managed correctly
• Reviewed the PR telemetry comment (informational)

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved review findings must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 4

Open (5)

• Add OAuth application identity fields to investigation_fields · New
• Use oauth_application_name for GitHub OAuth application identity · New
• Add legacy Data Source: Github tag · New
• Add Threat: OAuth App Consent taxonomy tag · New
• Add T1098.001 Account Manipulation ATT&CK mapping · New

What changed in this PR

Adds a GitHub EQL rule detecting oauth_authorization.create events.

Changes:

• Adds low-severity detection and ATT&CK mappings.
• Includes investigation guidance, references, and analyst fields.
• Configures GitHub audit-log ingestion handling.

File	Summary
rules/​integrations/​github/​persistence_github_oauth_application_authorized.toml	New GitHub OAuth authorization detection rule.

Review findings require correcting OAuth application fields, adding them to investigation fields, and updating taxonomy and data-source tags.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.