GitHub Private Repository Forking Enabled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GitHub Private Repository Forking Enabled

Detects enabling of private repository forking on a GitHub organization. Allowing forks of private repositories lets code leave the organization into personal forks, which is a common collection path after an org-owner compromise.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://docs.github.com/en/organizations/managing-organization-settings/managing-the-forking-policy-for-your-organization

Tags:

Domain: Cloud
Domain: SaaS
Platform: GitHub
Use Case: Threat Detection
Tactic: Collection
Tactic: Defense Evasion
Data Source: GitHub Audit Logs
Rule Type: ESQL
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GitHub Private Repository Forking Enabled

private_repository_forking.enable is an organization policy change. Follow with repo.fork if present.

Possible investigation steps

Identify user.name, github.org, and github.actor_ip.
Check whether private repos were forked afterward and to which accounts.

False positive analysis

Approved inner-source programs that temporarily enable forking.

Response and remediation

Disable private repository forking unless required. Review forks created in the same window and transfer or delete unauthorized copies.

Rule query

edit

from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "private_repository_forking.enable"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.visibility

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Collection
- ID: TA0009
- Reference URL: https://attack.mitre.org/tactics/TA0009/
Technique:
- Name: Data from Information Repositories
- ID: T1213
- Reference URL: https://attack.mitre.org/techniques/T1213/
Sub-technique:
- Name: Code Repositories
- ID: T1213.003
- Reference URL: https://attack.mitre.org/techniques/T1213/003/
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Domain or Tenant Policy Modification
- ID: T1484
- Reference URL: https://attack.mitre.org/techniques/T1484/

« First Time GCP Vertex AI Inference by Caller from Source ASN GitHub Webhook Created or Configuration Changed »