# Source: https://docs.datadoghq.com/security/default_rules/def-000-38f.md

---
title: >-
  GitHub mass exfiltration via cloning of repositories using a personal access
  token
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > GitHub mass exfiltration via cloning of
  repositories using a personal access token
---

# GitHub mass exfiltration via cloning of repositories using a personal access token
Classification:attackTactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1567-exfiltration-over-web-service](https://attack.mitre.org/techniques/T1567) 
## Goal{% #goal %}

Detects mass cloning of GitHub repositories using personal access tokens, indicating potential data exfiltration attempts. Alerts when users clone an unusually high number of distinct repositories within a short timeframe.

## Strategy{% #strategy %}

This rule monitors GitHub audit logs for `git.clone` actions performed using personal access tokens (both classic and fine-grained). The rule implements multiple severity thresholds based on the volume of repositories cloned and incorporates threat intelligence enrichment to identify cloning activity from suspicious IP addresses. Mass repository cloning using programmatic access tokens is a common technique used by malicious actors to exfiltrate large amounts of source code and sensitive data from organizations.

## Triage & Response{% #triage--response %}

- Examine the cloning activity timeline for `{{@github.actor}}` to determine if the volume and pattern of repository access aligns with legitimate business activities.
- Review the specific repositories cloned to assess their sensitivity level and whether the user has legitimate access requirements for all targeted repositories.
- Check the source IP addresses associated with the cloning activity and correlate with known user locations and typical access patterns.
- Analyze the user's recent GitHub activity history to identify any changes in behavior patterns or access requests.
- Determine if the cloned repositories contain sensitive data, proprietary code, or intellectual property that could pose significant risk if exfiltrated.

## Changelog{% #changelog %}

- 25 September 2025 - Updated to exclude the filter where actor is classified as bot in GitHub audit logs, `@actor_is_bot` indicator which isn't consistently populated in the audit logs.