OpenClaw - GitHub PAT Extraction (T1552.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

Detects the infostealer scraping .git-credentials or .git/config specifically targeting GitHub Personal Access Tokens (PATs). The rule identifies file access events where the file name is '.git-credentials' or 'config' within a folder path containing '.git', and the initiating process is 'python.exe'.