# A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs

DevFeed: [A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs](<https://devfeed.tech/articles/mapping-out-your-unknown-a-threat-hunter-s-guide-to-github-30894.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-github/>)

Author: Julie Agnes Sparks, Juvenal Araujo

Published: 2026-09-16T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Threat Hunting & Intel](<https://devfeed.tech/topics/threat-hunting-intel.md>), [Security](<https://devfeed.tech/topics/security.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [personal access token](<https://devfeed.tech/topics/personal-access-token.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [github](<https://devfeed.tech/tags/github.md>), [logging](<https://devfeed.tech/tags/logging.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [personal-access-token](<https://devfeed.tech/tags/personal-access-token.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>)

## AI overview

This article examines threats targeting GitHub organizations, including compromised accounts, personal access tokens, OAuth tokens, leaked secrets, phishing, and malicious extensions or OAuth apps. It describes GitHub audit-log queries and behaviors that can help detect account compromise, reconnaissance, and source-code exfiltration.

## Source excerpt

In this post, we walk through different threats to GitHub and how to detect them.