GitHub Audit Log: New Organization Member Added or Invited
Alerts on GitHub org audit events where a member is added or invited to a new or existing organization.
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-29
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub organization audit events where a user is added to an organization or invited as a new member. Attackers may abuse these actions to establish persistence or gain access by enrolling new accounts into a target org. It relies on GitHub audit log telemetry that records organization membership change actions such as org.add_member and org.invite_member.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_org_member.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub Audit Log: New Organization Member Added or Invited"
id: 888c23a7-2330-489d-905b-972384d0d85a
status: test
description: This rule flags GitHub organization audit events where a user is added to an organization or invited as a new member. Attackers may abuse these actions to establish persistence or gain access by enrolling new accounts into a target org. It relies on GitHub audit log telemetry that records organization membership change actions such as org.add_member and org.invite_member.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-29
references:
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_org_member.yml
tags:
- attack.persistence
- attack.t1136.003
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- org.add_member
- org.invite_member
condition: selection
falsepositives:
- Organization approved new members
level: informational
license: DRL-1.1
related:
- id: 3908d64a-3c06-4091-b503-b3a94424533b
type: derived