GitHub Audit: Private Repository Forking Policy Enabled or Cleared

title: "GitHub Audit: Private Repository Forking Policy Enabled or Cleared"
id: 54e3ff24-88b5-4842-bc92-81bcc823fe1b
status: test
description: This rule flags GitHub audit log events where the enterprise/repository/organization setting that controls whether private and internal repositories can be forked is enabled or cleared. Changing this policy can expand or restrict the ability for users to obtain copies of private code, which may affect data exposure and persistence opportunities. It relies on GitHub audit log events with actions private_repository_forking.enable or private_repository_forking.clear.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.persistence
  - attack.exfiltration
  - attack.t1020
  - attack.t1537
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - private_repository_forking.clear
      - private_repository_forking.enable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 69b3bd1e-b38a-462f-9a23-fbdbf63d2294
    type: derived