GitHub audit log: new org member added or invited

title: "GitHub audit log: new org member added or invited"
id: 888c23a7-2330-489d-905b-972384d0d85a
status: test
description: This rule flags events in the GitHub audit log when a user is added to an organization or invited as a new member. Adding or inviting members can enable persistence by expanding access for accounts that may later be used to access sensitive resources. The detection relies on GitHub audit events with actions matching org.add_member and org.invite_member.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-29
references:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_org_member.yml
tags:
  - attack.persistence
  - attack.t1136.003
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - org.add_member
      - org.invite_member
  condition: selection
falsepositives:
  - Organization approved new members
level: informational
license: DRL-1.1
related:
  - id: 3908d64a-3c06-4091-b503-b3a94424533b
    type: derived