LoFP LoFP / planned ownership moves during org restructuring or when an employee takes a personal project. confirm the destination owner and that the transfer was approved.

Techniques

Sample rules

GitHub Repository Transferred Out of Organization

Description

Identifies when a GitHub repository is transferred out of an organization. A repository transfer moves the source code, issue history, pull requests, wikis, and settings to another user or organization and removes it from the originating organization’s control. Adversaries who have compromised a privileged account or token use outgoing transfers to move intellectual property to an account they control, making this both a collection and an exfiltration technique that can bypass controls focused on cloning or archive downloads.

Detection logic

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "repo.transfer_outgoing"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.visibility,
    github.business