GitHub audit: outside collaborator membership and permissions changed

title: "GitHub audit: outside collaborator membership and permissions changed"
id: 29ef7873-9ffa-4ce6-a1c5-6fae79382c98
status: test
description: This rule flags GitHub audit log events where an outside collaborator is removed from an organization or where a project user’s permission level is changed. It also captures project board permission updates that could grant or reduce access for external collaborators. These actions matter because altering collaborator access can enable persistence, privilege escalation, or unauthorized data collection; the detection relies on GitHub audit log entries with matching action names.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-20
references:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_outside_collaborator_detected.yml
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.collection
  - attack.t1098.001
  - attack.t1098.003
  - attack.t1213.003
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - org.remove_outside_collaborator
      - project.update_user_permission
  condition: selection
falsepositives:
  - Validate the actor if permitted to access the repo.
  - Validate the Multifactor Authentication changes.
level: medium
license: DRL-1.1
related:
  - id: eaa9ac35-1730-441f-9587-25767bde99d7
    type: derived