GitHub Audit Log: New Organization Member Added or Invited

title: "GitHub Audit Log: New Organization Member Added or Invited"
id: 888c23a7-2330-489d-905b-972384d0d85a
status: test
description: This rule flags GitHub organization audit events where a user is added to an organization or invited as a new member. Attackers may abuse these actions to establish persistence or gain access by enrolling new accounts into a target org. It relies on GitHub audit log telemetry that records organization membership change actions such as org.add_member and org.invite_member.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-29
references:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_org_member.yml
tags:
  - attack.persistence
  - attack.t1136.003
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - org.add_member
      - org.invite_member
  condition: selection
falsepositives:
  - Organization approved new members
level: informational
license: DRL-1.1
related:
  - id: 3908d64a-3c06-4091-b503-b3a94424533b
    type: derived