Node process using hardcoded GitHub PAT or GITHUB_TOKEN env var to call GitHub Contents API
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Microsoft Sentinel (KQL)
