GitHub Audit Log: Repository or Organization Transfer Detected

title: "GitHub Audit Log: Repository or Organization Transfer Detected"
id: da78b655-e2e7-4dad-9179-9e7f6cd2124b
status: test
description: This rule flags GitHub audit events indicating a repository or an organization is being transferred to another location or account/network. Such transfers can be used to disrupt access, persist control, or move code/assets between environments. It relies on GitHub audit log records for migration creation and organization/repository transfer-related actions.
references:
  - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
  - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
  - https://docs.github.com/en/migrations
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repo_or_org_transferred.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
  - attack.persistence
  - attack.exfiltration
  - attack.t1020
  - attack.t1537
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - migration.create
      - org.transfer_outgoing
      - org.transfer
      - repo.transfer_outgoing
  condition: selection
falsepositives:
  - Allowed administrative activities.
level: medium
license: DRL-1.1
related:
  - id: 04ad83ef-1a37-4c10-b57a-81092164bf33
    type: derived