Skip to content
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
wiz.io | blog | #cloud | #incident-response | #github | #dfir | #playbook | #pat | #wiz | #token-compromise
Summary
Wiz CIRT's playbook from a multi-org campaign: compromised PATs cloned thousands of repos from 102 AWS IPs on June 1; it covers containment, timeline reconstruction, blast-radius mapping and hunting.
- Published
- Collected