Detects GitHub SSO recovery codes activity for GitHub Enterprise/organization, which are break-glass credentials bypassing Identity Provider controls. The rule analyzes GitHub audit logs (from logs-github.audit-*) to identify events where recovery codes are downloaded, generated, printed, viewed, used, or failed (both enterprise and org scopes). It projects fields such as _id, _index, _version, @timestamp, event.action, user.name, github.org, github.actor_ip, github.hashed_token, github.programmatic_access_type, github.user_agent, and github.business. The detection is mapped to credential-access and persistence objectives in MITRE ATT&CK: T1552 (Unsecured Credentials) and T1078 (Valid Accounts) with T1078.004 (Cloud Accounts) as a subtechnique, indicating potential misuse to gain access to GitHub cloud accounts. Correlation guidance includes cross-checking with events like MFA or SSO configuration changes (business.disable_saml, MFA disable) and new owner invites to identify potential compromise. False positives may arise from legitimate recovery-code rotation workflows with two-person integrity. Recommended actions include rotating recovery codes, reviewing SSO/MFA configurations, and forcing re-authentication for enterprise owners. The rule relies on the GitHub audit dataset and supports investigation by presenting fields such as timestamp, action, user, org, repo, actor IP, hashed token, access type, user agent, and business context. This rule is designed for threat-detection workflows focusing on credential abuse and persistence within GitHub Cloud services.