GitHub Repository Transferred Out of Organization

Last updated 2 months ago on 2026-09-21

Created 2 months ago on 2026-09-21

About

Identifies when a GitHub repository is transferred out of an organization. A repository transfer moves the source code, issue history, pull requests, wikis, and settings to another user or organization and removes it from the originating organization's control. Adversaries who have compromised a privileged account or token use outgoing transfers to move intellectual property to an account they control, making this both a collection and an exfiltration technique that can bypass controls focused on cloning or archive downloads.

Tags

Domain: CloudDomain: SaaSPlatform: GitHubUse Case: Threat DetectionTactic: CollectionTactic: ExfiltrationData Source: GithubData Source: GitHub Audit LogsRule Type: ES|QLLanguage: esql

Severity

medium

Risk Score

MITRE ATT&CK™

Exfiltration (TA0010)(external, opens in a new tab or window)

↳ Transfer Data to Cloud Account (T1537)(external, opens in a new tab or window)

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Information Repositories (T1213)(external, opens in a new tab or window)

False Positive Examples

Planned ownership moves during org restructuring or when an employee takes a personal project. Confirm the destination owner and that the transfer was approved.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: github(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "repo.transfer_outgoing"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent,
    github.visibility,
    github.business

Install detection rules in Elastic Security

Detect GitHub Repository Transferred Out of Organization in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).