gh-token-monitor Token Extraction via Grep

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects the gh-token-monitor script using grep to extract GitHub Classic or Fine-Grained tokens (matching the ghp_ or gho_ structure) from the filesystem. This rule specifically looks for process command lines containing 'grep' and the regex pattern 'gh[po]_[a-zA-Z0-9]{36}', which is indicative of searching for GitHub tokens.