Github Fork Private Repositories Setting Enabled/Cleared

Rule Info

Name
Github Fork Private Repositories Setting Enabled/Cleared
Author
Romain Gaillard (@romain-gaillard)
Description
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
Reference
https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking
Date
2024-07-29 00:00:00
Modified
None
Id
69b3bd1e-b38a-462f-9a23-fbdbf63d2294
Tags
attack.persistence attack.t1020 attack.t1537 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=69b3bd1e-b38a-462f-9a23-fbdbf63d2294

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Romain Gaillard
Merge PR #4931 from @romain-gaillard - Add additional GitHub audit detection rules
2024-07-29
e1803cbc8
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022