Defending Against GitHub API Recon: Ghost Accounts Campaign Detection & Mitigation

---
title: GitHub API Mass Reconnaissance - Member Enumeration
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential mass reconnaissance via GitHub API targeting organization members. High volume of GET requests to /orgs/*/members from a single source.
references:
 - https://docs.github.com/en/rest/orgs/members
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.discovery
 - attack.t1593
logsource:
 category: web
detection:
 selection:\   cs-method: 'GET'
   cs-host|contains: 'api.github.com'
   cs-uri|contains: '/members'
 condition: selection | count() by src_ip > 20
falsepositives:
 - Legitimate auditing scripts
 - High-activity onboarding tools
level: high
---
title: GitHub API Mass Reconnaissance - Repository Enumeration
id: 9b5c3d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential mass reconnaissance via GitHub API targeting repositories within an organization.
references:
 - https://docs.github.com/en/rest/repos/repos
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.discovery
 - attack.t1593
logsource:
 category: web
detection:
 selection:
   cs-method: 'GET'
   cs-host|contains: 'api.github.com'
   cs-uri|contains: '/repos'
 condition: selection | count() by src_ip > 20
falsepositives:
 - Legitimate repository management tools
level: medium

// Hunt for GitHub API enumeration targeting members or repos
CommonSecurityLog
| where DestinationPort == 443
| where RequestURL contains \"api.github.com\"
| where RequestMethod == \"GET\"
| extend UriPath = extract(@\"\/api\\.github\\.com\/[^\\?]+\", 0, RequestURL)
| where UriPath contains \"/members\" or UriPath contains \"/repos\"
| summarize Count = count(), UniqueUris = dcount(UriPath) by SourceIP, UserAgent, bin(TimeGenerated, 10m)
| where Count > 50 or UniqueUris > 10
| order by Count desc
| project TimeGenerated, SourceIP, UserAgent, Count, UniqueUris

-- Hunt for processes communicating with api.github.com
-- Useful for identifying compromised internal hosts participating in recon or using stolen tokens
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name IN ('git.exe', 'python.exe', 'node.exe', 'curl.exe', 'powershell.exe')
  AND Pid IN (
      SELECT Pid
      FROM netstat()
      WHERE RemoteAddress =~ 'api.github.com'
         OR RemoteAddress =~ 'github.com'
  )

# GitHub Organization Ghost Account Auditor
# Requires: gh cli (https://cli.github.com/)

param(
    [Parameter(Mandatory=$true)]
    [string]$OrgName
)

Write-Host \"[+] Auditing Organization: $OrgName\" -ForegroundColor Cyan

# Check if gh is installed and authenticated
$null = gh auth status 2>&1
if ($LASTEXITCODE -ne 0) {
    Write-Host \"[-] Error: GitHub CLI not found or not authenticated. Run 'gh auth login' first.\" -ForegroundColor Red
    exit 1
}

# Fetch all members
Write-Host \"[*] Fetching member list...\" -ForegroundColor Yellow
$members = gh api --paginate \"orgs/$OrgName/members\" | ConvertFrom-Json

Write-Host \"[+] Found $($members.Count) members. Analyzing profiles...\" -ForegroundColor Green

$suspiciousUsers = @()

foreach ($member in $members) {
    $userDetail = gh api \"users/$($member.login)\" | ConvertFrom-Json
    
    # Heuristics for Ghost Accounts
    $isGhost = $false
    $reasons = @()

    if ($userDetail.public_repos -eq 0 -and $userDetail.followers -eq 0) {
        $isGhost = $true
        $reasons += \"0 Public Repos and 0 Followers\"
    }
    
    $accountAge = (Get-Date) - [datetime]$userDetail.created_at
    if ($accountAge.Days -lt 30) {
        $isGhost = $true
        $reasons += \"Account created < 30 days ago\"
    }

    if ($isGhost) {
        $suspiciousUsers += [PSCustomObject]@{
            Username = $userDetail.login
            Type = $userDetail.type
            Created = $userDetail.created_at
            PublicRepos = $userDetail.public_repos
            Followers = $userDetail.followers
            Reasons = ($reasons -join ', ')
        }
    }
}

if ($suspiciousUsers.Count -gt 0) {
    Write-Host \"[!] ALERT: Found $($suspiciousUsers.Count) potentially suspicious ghost accounts:\" -ForegroundColor Red
    $suspiciousUsers | Format-Table -AutoSize
} else {
    Write-Host \"[+] No obvious ghost account patterns detected based on heuristics.\" -ForegroundColor Green
}

# Check Organization Audit Log for recent failed auths or heavy API usage (Requires Admin Access)
Write-Host \"[*] Checking recent Audit Log entries for high-frequency API access...\" -ForegroundColor Yellow
$auditEvents = gh api \"orgs/$OrgName/audit-log?phrase=action:api&per_page=50\" 2>$null
if ($auditEvents) {
    Write-Host \"[+] Review recent API audit logs manually in GitHub UI for clustered IPs.\" -ForegroundColor Cyan
} else {
    Write-Host \"[-] Could not retrieve audit logs (Requires Org Admin privileges).\" -ForegroundColor DarkYellow
}