This rule detects creation or configuration changes of GitHub webhooks by monitoring GitHub audit logs for hook.create and hook.config_changed actions performed by non-bot actors. It targets the risk of attacker-controlled webhooks that can copy repository events (pushes, pull requests, workflows) and potentially exfiltrate secrets contained in those payloads to an external URL. The ESQ L query filters the github.audit dataset for non-bot actors and the relevant webhook events, returning fields such as user.name, repo, actor_ip, hook_id, hook name, and token/workflow context to aid investigation. The rule maps to MITRE ATT&CK techniques T1213.003 (Code Repositories, Data from Information Repositories) under Collection and T1567.004 (Exfiltration Over Webhook) under Exfiltration. A nine-minute initial window supports near-real-time detection. Suggested investigation steps include validating payload URLs and events in Settings → Webhooks, correlating with related actions (git.push, repo.download_zip, secret creation), and verifying actor legitimacy. False positives can arise from legitimate integrations (Slack, Jira, deploy bots) or infrastructure as code automation (Terraform, GitHub Apps). Remediation guidance includes deleting unauthorized webhooks, rotating potentially exposed secrets, and revoking the actor’s tokens if not approved.