Mapping out your unknown: A threat hunter’s guide to GitHub

This Datadog security post explains common attacker techniques against GitHub organizations—compromised tokens and accounts, OAuth and app abuse, repository and secret enumeration, and bulk collection (clones/ZIP downloads)—and provides concrete GitHub audit-log queries and hunt/detection guidance to identify suspicious logins, token usage, secret listing, repo enumeration, and exfiltration behaviors.