GitHub Enterprise Or Organization Recovery Codes Activity

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•1•0•0

Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.