GitHub Personal Access Token Addition Notification
Detects email notifications regarding the addition of a new Personal Access Token (PAT) to a GitHub account. This activity is often a precursor to unauthorized API access if an adversary has compromised a user's account.
Microsoft Sentinel (KQL)

