GitHub Private Repository Forking Enabled

  1[metadata]
  2creation_date = "2026/11/02"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/11/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects enabling of private repository forking on a GitHub organization. Allowing forks of private repositories lets
 11code leave the organization into personal forks, which is a common collection path after an org-owner compromise.
 12"""
 13false_positives = [
 14    """
 15    Planned policy change to allow inner-source forks. Confirm change tickets and that the setting is reverted if it was
 16    a test.
 17    """,
 18]
 19from = "now-9m"
 20language = "esql"
 21license = "Elastic License v2"
 22name = "GitHub Private Repository Forking Enabled"
 23note = """## Triage and analysis
 24
 25### Investigating GitHub Private Repository Forking Enabled
 26
 27`private_repository_forking.enable` is an organization policy change. Follow with `repo.fork` if present.
 28
 29### Possible investigation steps
 30
 31- Identify `user.name`, `github.org`, and `github.actor_ip`.
 32- Check whether private repos were forked afterward and to which accounts.
 33
 34### False positive analysis
 35
 36- Approved inner-source programs that temporarily enable forking.
 37
 38### Response and remediation
 39
 40- Disable private repository forking unless required. Review forks created in the same window and transfer or delete unauthorized copies.
 41"""
 42references = [
 43    "https://docs.github.com/en/organizations/managing-organization-settings/managing-the-forking-policy-for-your-organization",
 44]
 45risk_score = 47
 46rule_id = "fa2a3164-4e7e-4760-8831-f717e85e1088"
 47severity = "medium"
 48tags = [
 49    "Domain: Cloud",
 50    "Domain: SaaS",
 51    "Platform: GitHub",
 52    "Use Case: Threat Detection",
 53    "Tactic: Collection",
 54    "Tactic: Defense Evasion",
 55    "Data Source: GitHub Audit Logs",
 56    "Rule Type: ESQL",
 57    "Resources: Investigation Guide",
 58]
 59timestamp_override = "event.ingested"
 60type = "esql"
 61
 62query = '''
 63from logs-github.audit-* metadata _id, _index, _version
 64| where
 65  event.module == "github" and data_stream.dataset == "github.audit"
 66    and event.action == "private_repository_forking.enable"
 67| keep
 68    _id,
 69    _index,
 70    _version,
 71    @timestamp,
 72    event.action,
 73    user.name,
 74    github.org,
 75    github.repo,
 76    github.actor_ip,
 77    github.hashed_token,
 78    github.programmatic_access_type,
 79    github.user_agent,
 80    github.visibility
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1213"
 88name = "Data from Information Repositories"
 89reference = "https://attack.mitre.org/techniques/T1213/"
 90[[rule.threat.technique.subtechnique]]
 91id = "T1213.003"
 92name = "Code Repositories"
 93reference = "https://attack.mitre.org/techniques/T1213/003/"
 94
 95
 96
 97[rule.threat.tactic]
 98id = "TA0009"
 99name = "Collection"
100reference = "https://attack.mitre.org/tactics/TA0009/"
101[[rule.threat]]
102framework = "MITRE ATT&CK"
103[[rule.threat.technique]]
104id = "T1484"
105name = "Domain or Tenant Policy Modification"
106reference = "https://attack.mitre.org/techniques/T1484/"
107
108
109[rule.threat.tactic]
110id = "TA0005"
111name = "Defense Evasion"
112reference = "https://attack.mitre.org/tactics/TA0005/"
113
114[rule.investigation_fields]
115field_names = [
116    "@timestamp",
117    "event.action",
118    "user.name",
119    "github.org",
120    "github.repo",
121    "github.actor_ip",
122    "github.hashed_token",
123    "github.programmatic_access_type",
124    "github.user_agent",
125    "github.visibility",
126]