GitHub Personal Access Token Creation

tayvion payton@tayontech

•updated Feb 21, 2026•1•0•57

Detects the creation of a new Personal Access Token (PAT) in GitHub. Attackers frequently create PATs after gaining initial access to an account to maintain persistence that survives a password reset. Tokens with broad scopes (repo, admin:org) allow for full repository exfiltration and administrative manipulation of the organization.