Org Credential Authorization
| action | Description | Sample | Rule |
|---|---|---|---|
| org_ | A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization. | Y | Y |
| org_ | A member authorized credentials for use with SAML or OIDC single sign-on. | Y | Y |
| org_ | An owner revoked authorized credentials. | N | Y |
org_credential_authorization.deauthorize
#- Category
- org-credential-authorization
Description
A member removed the SSO (SAML or OIDC) authorization from a credential that had access to your organization.
Documented on GitHub's enterprise audit log reference. Events that co-occur with this one in the same detection rules (shared multi-event coverage), most-shared first. These are likely companion or next steps to pivot an investigation to. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000159,
"token_id": 9000160,
"created_at": 1785228406079.0,
"business_id": 9000005,
"actor_is_bot": false,
"org": "example-org",
"actor": "user",
"action": "org_credential_authorization.deauthorize",
"business": "example-business",
"token_scopes": "",
"operation_type": "remove",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Related events #
Detection Rules #
YARA-L #
T1562↳ also matches org_credential_authorization.grant, org_credential_authorization.revoke References #
org_credential_authorization.grant
#- Category
- org-credential-authorization
Description
A member authorized credentials for use with SAML or OIDC single sign-on.
Documented on GitHub's enterprise audit log reference. Events that co-occur with this one in the same detection rules (shared multi-event coverage), most-shared first. These are likely companion or next steps to pivot an investigation to. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"org_id": 9000002,
"actor_id": 9000161,
"token_id": 9000162,
"created_at": 1785228373080.0,
"business_id": 9000005,
"actor_is_bot": false,
"application_id": 9000163,
"org": "example-org",
"actor": "user",
"action": "org_credential_authorization.grant",
"actor_ip": "ip-redacted",
"business": "example-business",
"request_id": 9000164,
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0",
"token_scopes": "",
"actor_location": {
"country_code": "XX"
},
"operation_type": "create",
"application_name": "example-label-143",
"application_type": "Integration",
"oauth_credential_type": "OauthAccess",
"external_identity_nameid": "user",
"external_identity_username": "user"
}
Related events #
Detection Rules #
YARA-L #
T1562↳ also matches org_credential_authorization.deauthorize, org_credential_authorization.revoke References #
org_credential_authorization.revoke
#- Category
- org-credential-authorization
Description
An owner revoked authorized credentials.
Documented on GitHub's enterprise audit log reference. Events that co-occur with this one in the same detection rules (shared multi-event coverage), most-shared first. These are likely companion or next steps to pivot an investigation to. Full rule details for this event, including ATT&CK technique mappings and native queries →Related events #
Detection Rules #
YARA-L #
T1562↳ also matches org_credential_authorization.deauthorize, org_credential_authorization.grant