Grafana GitHub Token Breach: Detecting Source Code Exfiltration and Extortion Vectors

---
title: Potential Git Repository Exfiltration via Clone
id: 8c2f9e10-1d5a-4b6c-9f0a-3b4c5d6e7f8a
status: experimental
description: Detects the use of git.exe to perform a clone operation, which may indicate source code exfiltration if the user/host is unexpected.
references:
 - https://thehackernews.com/2026/05/grafana-github-token-breach-led-to.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.collection
 - attack.t1005
logsource:
 category: process_creation
 product: windows
detection:
  selection:
    Image|endswith:
      - '\git.exe'
      - '\git.cmd'
    CommandLine|contains:
      - 'clone '
      - 'clone --'
  condition: selection
falsepositives:
  - Legitimate developers cloning repositories (filter by specific developer user groups if necessary)
level: medium
---
title: Git Execution by Non-Interactive Shell or Web Server
id: 9d3e0f21-2e6b-5c7d-0a1b-4c5d6e7f8a9b
status: experimental
description: Detects git.exe spawned by web servers or non-interactive shells, indicating potential web shell activity or automated exfiltration scripts.
references:
 - https://thehackernews.com/2026/05/grafana-github-token-breach-led-to.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.execution
 - attack.t1059.004
logsource:
 category: process_creation
 product: windows
detection:
  selection_img:
    Image|endswith:
      - '\git.exe'
      - '\git.cmd'
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate deployment scripts triggered by web hooks (rare in production, verify)
level: high
---
title: Large Data Transfer to GitHub via Process
id: 1e4f1a32-3f7c-6d8e-1b2c-5d6e7f8a9b0c
status: experimental
description: Detects potential source code exfiltration by monitoring network connections to GitHub initiated by Git processes.
references:
 - https://thehackernews.com/2026/05/grafana-github-token-breach-led-to.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.exfiltration
 - attack.t1041
logsource:
 category: network_connection
 product: windows
detection:
  selection:
    DestinationHostname|endswith:
      - 'github.com'
      - 'githubusercontent.com'
    Initiated: 'true'
    Image|endswith:
      - '\git.exe'
      - '\git-remote-http.exe'
  filter_legit_dev:
    User|contains: # Add your developer user account suffixes here
      - 'admin'
      - 'devops'
  condition: selection and not filter_legit_dev
falsepositives:
  - Valid developer push/pull operations
level: low

let GitProcesses = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("git.exe", "git")
| where ProcessCommandLine has_any ("clone", "fetch", "push", "pull")
| project DeviceId, DeviceName, AccountName, ProcessCommandLine, ProcessId, Timestamp;
let NetworkEgress = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("github.com", "api.github.com")
| where InitiatingProcessId in (GitProcesses | distinct ProcessId)
| where SentBytes > 10485760 // 10MB threshold to flag potential bulk download
| project DeviceId, RemoteUrl, SentBytes, InitiatingProcessAccountName;
GitProcesses
| join kind=inner NetworkEgress on DeviceId
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, SentBytes
| order by Timestamp desc

-- Hunt for active Git processes and GitHub connections
SELECT
  P.Pid,
  P.Name,
  P.Cmdline,
  N.RemoteAddress,
  N.RemotePort,
  P.Username
FROM pslist()
LEFT JOIN foreach(row={
    SELECT * FROM netstat() WHERE Pid = P.Pid
}, query={
    SELECT
        RemoteAddress,
        RemotePort,
        Pid
    FROM scope()
}) AS N
WHERE Name =~ 'git'
  AND (
    RemoteAddress =~ '140.82.112.*' OR
    RemoteAddress =~ '192.30.255.*' OR
    RemoteAddress =~ '185.199.108.*' OR
    RemoteAddress =~ 'github.com'
  )

<#
.SYNOPSIS
    Audits directory for potential leaked GitHub Tokens.
.DESCRIPTION
    Scans files for patterns resembling GitHub PATs (ghp_, github_pat_) to prevent credential leakage.
#>

$ErrorActionPreference = "SilentlyContinue"
$ScanPath = Read-Host "Enter path to scan (e.g., C:\Repos or . for current directory)"
$Patterns = @(
    "ghp_[a-zA-Z0-9]{36}",      # Classic PAT
    "github_pat_[a-zA-Z0-9_]{82}", # Fine-grained PAT
    "gho_[a-zA-Z0-9]{36}",      # OAuth Token
    "ghu_[a-zA-Z0-9]{36}"       # User Token
)

Write-Host "[+] Initiating Secret Hygiene Audit on: $ScanPath" -ForegroundColor Cyan

$Files = Get-ChildItem -Path $ScanPath -Recurse -File -Include *.py,*.js,*.ts,*.,*.yml,*.yaml,*.tf,*.env,*.ps1,*.sh

Foreach ($File in $Files) {
    $Content = Get-Content $File.FullName -Raw
    if ($null -eq $Content) { continue }

    foreach ($Pattern in $Patterns) {
        if ($Content -match $Pattern) {
            Write-Host "[!] POTENTIAL LEAK DETECTED" -ForegroundColor Red
            Write-Host "    File: $($File.FullName)" -ForegroundColor Yellow
            Write-Host "    Pattern: $Pattern" -ForegroundColor Yellow
            # Output first 100 chars of match context for verification
            $match = $matches[0]
            Write-Host "    Match: $match`n" -ForegroundColor Yellow
        }
    }
}
Write-Host "[+] Audit Complete. Review findings immediately." -ForegroundColor Green