GitHub Audit Logs: Private/Internal Forking Policy Enabled or Cleared

title: "GitHub Audit Logs: Private/Internal Forking Policy Enabled or Cleared"
id: 54e3ff24-88b5-4842-bc92-81bcc823fe1b
status: test
description: This rule flags changes to the GitHub enterprise/repository/organization policy that controls whether private and internal repositories can be forked. Allowing or clearing this setting can materially affect data exposure and persistence by changing who can create forks of restricted code. It relies on GitHub audit log events capturing the specific policy state transition actions.
references:
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.persistence
  - attack.exfiltration
  - attack.t1020
  - attack.t1537
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - private_repository_forking.clear
      - private_repository_forking.enable
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 69b3bd1e-b38a-462f-9a23-fbdbf63d2294
    type: derived