GitHub Repository Transferred Out of Organization

  1[metadata]
  2creation_date = "2026/09/21"
  3integration = ["github"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when a GitHub repository is transferred out of an organization. A repository transfer moves the source code,
 11issue history, pull requests, wikis, and settings to another user or organization and removes it from the originating
 12organization's control. Adversaries who have compromised a privileged account or token use outgoing transfers to move
 13intellectual property to an account they control, making this both a collection and an exfiltration technique that can
 14bypass controls focused on cloning or archive downloads.
 15"""
 16false_positives = [
 17    """
 18    Planned ownership moves during org restructuring or when an employee takes a personal project. Confirm the
 19    destination owner and that the transfer was approved.
 20    """,
 21]
 22from = "now-9m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "GitHub Repository Transferred Out of Organization"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating GitHub Repository Transferred Out of Organization
 32
 33The `repo.transfer_outgoing` audit action is logged when a repository is sent from the organization to another user or organization. A transfer hands over the full repository (code, issues, pull requests, and settings) and removes it from the source organization's visibility, so an unauthorized transfer can permanently exfiltrate intellectual property to an attacker-controlled account. Review the actor (`user.name`, `github.actor_ip`), the token used (`github.hashed_token`, `github.programmatic_access_type`), and the repository and its sensitivity (`github.repo`, `github.visibility`) to determine whether the transfer was approved, and identify the destination owner to assess exposure.
 34
 35### Possible investigation steps
 36
 37- Identify the actor and token behind the transfer using `user.name`, `github.actor_ip`, `github.hashed_token`, and `github.programmatic_access_type`, and confirm whether the actor is a repository or organization administrator who would normally perform transfers.
 38- Determine the destination owner of the transfer from the GitHub audit log or UI, and assess whether it is a known company organization or an external, attacker-controlled account.
 39- Review `github.repo` and `github.visibility` to understand the sensitivity of the transferred repository, prioritizing private repositories and those containing source code or secrets.
 40- Check for additional `repo.transfer_outgoing` events from the same actor or token in a short window, which can indicate bulk exfiltration of multiple repositories.
 41- Review the actor's surrounding GitHub activity for clones, archive downloads, collaborator additions, or visibility changes that suggest broader account compromise.
 42
 43### False positive analysis
 44
 45- Planned ownership moves during organizational restructuring, mergers, or consolidation between company-owned organizations. Confirm the destination owner and that the transfer was approved through change management.
 46- Transfer of a personal or non-sensitive project to an employee's account during offboarding. Validate against HR or offboarding records and scope exceptions to the specific actor and repository where appropriate.
 47
 48### Response and remediation
 49
 50- If the transfer is unauthorized, contact GitHub Support immediately to attempt to reverse it while the window to do so is still open.
 51- Revoke the token identified by `github.hashed_token` and the actor's other tokens, and require the user to reauthenticate.
 52- Review and, if necessary, reset organization ownership and administrative permissions to prevent further transfers.
 53- Inventory the organization's remaining repositories for additional outgoing transfers, visibility changes, or collaborator additions by the same actor.
 54- Rotate any secrets or deploy keys that were stored in the transferred repository, and engage incident response per your organization's playbooks if sensitive data was exposed.
 55"""
 56references = [
 57    "https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository",
 58]
 59risk_score = 47
 60rule_id = "35466375-aa84-4e8f-9021-0e99f6a57614"
 61severity = "medium"
 62tags = [
 63    "Domain: Cloud",
 64    "Domain: SaaS",
 65    "Platform: GitHub",
 66    "Use Case: Threat Detection",
 67    "Tactic: Collection",
 68    "Tactic: Exfiltration",
 69    "Data Source: Github",
 70    "Data Source: GitHub Audit Logs",
 71    "Rule Type: ES|QL",
 72    "Resources: Investigation Guide",
 73]
 74timestamp_override = "event.ingested"
 75type = "esql"
 76
 77query = '''
 78from logs-github.audit-* metadata _id, _index, _version
 79| where
 80  event.module == "github" and data_stream.dataset == "github.audit"
 81    and event.action == "repo.transfer_outgoing"
 82| keep
 83    _id,
 84    _index,
 85    _version,
 86    @timestamp,
 87    event.action,
 88    user.name,
 89    github.org,
 90    github.repo,
 91    github.actor_ip,
 92    github.hashed_token,
 93    github.programmatic_access_type,
 94    github.user_agent,
 95    github.visibility,
 96    github.business
 97'''
 98
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102[[rule.threat.technique]]
103id = "T1537"
104name = "Transfer Data to Cloud Account"
105reference = "https://attack.mitre.org/techniques/T1537/"
106
107
108[rule.threat.tactic]
109id = "TA0010"
110name = "Exfiltration"
111reference = "https://attack.mitre.org/tactics/TA0010/"
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114[[rule.threat.technique]]
115id = "T1213"
116name = "Data from Information Repositories"
117reference = "https://attack.mitre.org/techniques/T1213/"
118[[rule.threat.technique.subtechnique]]
119id = "T1213.003"
120name = "Code Repositories"
121reference = "https://attack.mitre.org/techniques/T1213/003/"
122
123
124
125[rule.threat.tactic]
126id = "TA0009"
127name = "Collection"
128reference = "https://attack.mitre.org/tactics/TA0009/"
129
130[rule.investigation_fields]
131field_names = [
132    "@timestamp",
133    "event.action",
134    "user.name",
135    "github.org",
136    "github.repo",
137    "github.actor_ip",
138    "github.hashed_token",
139    "github.programmatic_access_type",
140    "github.user_agent",
141    "github.visibility",
142    "github.business",
143]