GitHub Personal Access Token Exfiltrated
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
Suricata
