Identifies when a GitHub repository is transferred out of an organization by monitoring the repo.transfer_outgoing action in GitHub audit logs. A repository transfer moves the complete repository (code, issues, pull requests, wikis, and settings) to another user or organization and removes it from the source organization’s control. Detecting unauthorized outgoing transfers is critical because attackers who gain privileged access or stolen tokens can exfiltrate intellectual property, bypassing controls that focus on cloning or archive downloads. The rule analyzes the GitHub audit data stream to surface key indicators: the actor (user.name), source organization (github.org), repository (github.repo), actor IP (github.actor_ip), token evidence (github.hashed_token, github.programmatic_access_type), user agent, repository visibility (github.visibility), and any business context (github.business). The query maps to MITRE ATT&CK techniques T1537 (Transfer Data to Cloud Account) under Exfiltration and T1213.003 (Code Repositories) under Collection, signaling both data movement to an external account and collection of repository data. The investigation fields and the event lineage enable analysts to determine whether a transfer was approved, identify the destination owner, and assess repository sensitivity. Possible investigation steps include: - Identify actor and token details to confirm whether the transfer was performed by a privileged administrator and whether the token is compromised. - Determine the destination owner from logs or UI and assess if it’s an external account or a known internal entity. - Review repository sensitivity (private vs public, code and secrets contained) and the scope of impact. - Look for additional repo.transfer_outgoing events from the same actor/token in a short window to detect bulk exfiltration. - Correlate surrounding GitHub activity (clones, archive downloads, new collaborators, visibility changes) for signs of broader compromise. False positives include planned ownership changes during restructuring or offboarding transfers of personal projects. Validate against change-management records and scope exceptions accordingly. Response and remediation guidance includes reversing unauthorized transfers with GitHub Support if possible, revoking involved tokens (github.hashed_token) and reauthentication, reviewing and tightening organization ownership and admin permissions, inventorying remaining repositories for similar transfers, and rotating any secrets or deploy keys stored in transferred repositories. Incident response playbooks should be engaged if sensitive data was exposed.