Detects GitHub token usage (git clone, git push, or repository ZIP download) authenticated with a classic PAT, fine-grained PAT, or OAuth token from a source ASN not previously seen for that user within a 7-day window. Uses IP_LOCATION to resolve the actor IP to ASN at query time, mitigating address churn within the same ISP or cloud provider. A token used from an unfamiliar ASN can indicate credential theft or misuse from an unauthorized location. The rule groups events by user and ASN, computing first_seen/last_seen, repos, actions, token identifiers, and IP/asn context to surface novel activity. A sibling rule applies similar ASN-based novelty detection for private repos. It is designed to minimize false positives from legitimate network mobility by focusing on new ASN per user rather than every new IP within the same ASN. It maps to MITRE ATT&CK techniques related to exfiltration, collection, and initial access, and provides structured investigation steps and remediation guidance.