GitHub Audit: Repository or Organization Transfer Events

Alerts on GitHub audit log events for repository or organization transfers between environments/accounts.

FreeUnreviewedSigmamediumv1

github-audit-repository-or-organization-transfer-events-04ad83ef

title: "GitHub Audit: Repository or Organization Transfer Events"
id: da78b655-e2e7-4dad-9179-9e7f6cd2124b
status: test
description: This rule flags GitHub audit events indicating that a repository or an organization is being transferred to another location or account. Such transfers can be used to move assets between environments while potentially evading monitoring or changing administrative control. It relies on GitHub audit log telemetry for actions like migration creation, org transfer, and repo transfer outgoing events.
references:
  - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
  - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
  - https://docs.github.com/en/migrations
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repo_or_org_transferred.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.persistence
  - attack.exfiltration
  - attack.t1020
  - attack.t1537
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - migration.create
      - org.transfer_outgoing
      - org.transfer
      - repo.transfer_outgoing
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 04ad83ef-1a37-4c10-b57a-81092164bf33
    type: derived

What it detects

This rule flags GitHub audit events indicating that a repository or an organization is being transferred to another location or account. Such transfers can be used to move assets between environments while potentially evading monitoring or changing administrative control. It relies on GitHub audit log telemetry for actions like migration creation, org transfer, and repo transfer outgoing events.

Known false positives

Allowed administrative activities.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.