GitHub Audit Log: Repository or Organization Transfer Detected
Alerts on GitHub audit log events for repository or organization transfers between environments/accounts.
FreeReviewedSigma · Medium · v5
- Product
- github
- Service
- audit
- Author
- Romain Gaillard (@romain-gaillard) (SigmaHQ), DRL 1.1
- Published
- 2024-07-29
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Impact
What it detects
This rule flags GitHub audit events indicating a repository or an organization is being transferred to another location or account/network. Such transfers can be used to disrupt access, persist control, or move code/assets between environments. It relies on GitHub audit log records for migration creation and organization/repository transfer-related actions.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
- docs.github.comhttps://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
- docs.github.comhttps://docs.github.com/en/migrations
- docs.github.comhttps://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repo_or_org_transferred.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
github-audit-repository-or-organization-transfer-events-04ad83ef
title: "GitHub Audit Log: Repository or Organization Transfer Detected"
id: da78b655-e2e7-4dad-9179-9e7f6cd2124b
status: test
description: This rule flags GitHub audit events indicating a repository or an organization is being transferred to another location or account/network. Such transfers can be used to disrupt access, persist control, or move code/assets between environments. It relies on GitHub audit log records for migration creation and organization/repository transfer-related actions.
references:
- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
- https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
- https://docs.github.com/en/migrations
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repo_or_org_transferred.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
- attack.persistence
- attack.exfiltration
- attack.t1020
- attack.t1537
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- migration.create
- org.transfer_outgoing
- org.transfer
- repo.transfer_outgoing
condition: selection
falsepositives:
- Allowed administrative activities.
level: medium
license: DRL-1.1
related:
- id: 04ad83ef-1a37-4c10-b57a-81092164bf33
type: derived