# Source: https://docs.datadoghq.com/security/default_rules/def-000-a74.md

---
title: GitHub mass zip file exfiltration of repositories using an OAuth access token
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > GitHub mass zip file exfiltration of
  repositories using an OAuth access token
---

# GitHub mass zip file exfiltration of repositories using an OAuth access token
Classification:attackTactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1567-exfiltration-over-web-service](https://attack.mitre.org/techniques/T1567) 
## Goal{% #goal %}

Detects mass downloading of repository zip files using OAuth access tokens, which could indicate data exfiltration.

## Strategy{% #strategy %}

This rule monitors GitHub audit logs for `repo.download_zip` events performed using OAuth access tokens. The detection focuses on tracking actors using OAuth tokens (including those created before April 2021) to download multiple distinct repositories within a short timeframe. The rule specifically filters for programmatic access using OAuth tokens while excluding bot accounts.

The strategy involves tracking the number of distinct repositories downloaded by each actor to identify potential exfiltration attempts. When an actor downloads multiple repositories in a condensed timeframe using OAuth tokens, it could represent suspicious mass data collection activity. The rule includes additional context by incorporating threat intelligence data to identify suspicious source IPs.

## Triage & Response{% #triage--response %}

- Verify if the repositories downloaded are sensitive or contain proprietary code.
- Examine the OAuth token's creation date, permissions, and associated application.
- Review the user's (`{{@github.actor}}`) access history and normal usage patterns to determine if this behavior is unusual.
- Revoke the OAuth token used in the suspicious activity.
- Rotate any exposed secrets that might have been in the downloaded repositories.
- Review existing OAuth applications and their permission scopes across your organization.
- Implement stricter OAuth token policies and consider using fine-grained tokens with limited repository access.

## Changelog{% #changelog %}

- 25 September 2025 - Updated to exclude where actor is classified as bot in GitHub audit logs rather than use the `@actor_is_bot:false` indicator which isn't consistently populated in the audit log.