Detecting GitHound Enumeration via the GitHub APIFor many organizations, GitHub Enterprise serves as a central platform for software development, collaboration, and source code management. This makes it an increasingly valuable target for attackers seeking access to source code, sensitive information, credentials, and development infrastructure. Recent incidents demonstrate an increasing preference among attackers for targeting GitHub environments. In March 2026, the Trivy supply-chain attack involved stolen credentials being used to publish malicious releases and tamper with GitHub Actions.

Upon digging around Microsoft’s documentation for user-defined functions I stumbled on the function pair_probabilities_fl(). This function calculates probabilities and some additional metrics for a pair of categorical variables, A and B. In this blog post, we are exploring the possibility of using the pair probabilities function for threat hunting. The documentation explains the output metrics in detail, but I am going to briefly go through the key points to help provide some context for the rest of the blog.