← All keys & policies
Key·user
Web session cookie
Tier 0 · CriticalControl
Why Tier 0
Acts as the signed-in account in the browser, with everything that account can do, including its settings. For an organization or enterprise owner that is Tier 0. It was issued after the password and 2FA, so a stolen cookie skips both.
The cookie that keeps a person signed in to GitHub in the browser.
Available on: Every setup. Source
Attack path
Infostealer malware copies browser cookies. Replayed elsewhere, the session is already past the password and 2FA, and SSO for the organization may still be valid. The attacker can then create tokens, add SSH keys or change settings as that person.
Mitigations
- Review and revoke sessions in the account's security settings after a suspected infection
- Keep owner accounts on managed devices, and use a separate account for day-to-day work
- Alert on new personal access tokens, SSH keys and OAuth grants for owner accounts
Detect
Alert on org.sso_response, business.sso_response, business.revoke_sso_session in the audit log (the closest events GitHub logs).