GitHub Audit: Outside Collaborator Membership and Permission Changes
Alerts on GitHub audit events involving outside collaborators being removed or permission changes on projects.
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-20
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → CollectionRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit log events where an outside collaborator is removed or where a user’s project board permissions are updated. Such changes can be used to reduce access for defenders or alter project access to support persistence and data collection. The detection relies on GitHub audit events for collaborator removal and project permission updates, including the associated actor and organization/project context.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_outside_collaborator_detected.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub Audit: Outside Collaborator Membership and Permission Changes"
id: 29ef7873-9ffa-4ce6-a1c5-6fae79382c98
status: test
description: This rule flags GitHub audit log events where an outside collaborator is removed or where a user’s project board permissions are updated. Such changes can be used to reduce access for defenders or alter project access to support persistence and data collection. The detection relies on GitHub audit events for collaborator removal and project permission updates, including the associated actor and organization/project context.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-20
references:
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_outside_collaborator_detected.yml
tags:
- attack.privilege-escalation
- attack.persistence
- attack.collection
- attack.t1098.001
- attack.t1098.003
- attack.t1213.003
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- org.remove_outside_collaborator
- project.update_user_permission
condition: selection
falsepositives:
- Validate the actor if permitted to access the repo.
- Validate the Multifactor Authentication changes.
level: medium
license: DRL-1.1
related:
- id: eaa9ac35-1730-441f-9587-25767bde99d7
type: derived