
Summary
The GitHub Repository Collaborator Change detection rule identifies changes in repository collaboration status by monitoring GitHub audit logs. Specifically, it triggers alerts when a user is added to or removed from the list of collaborators for a repository. This is crucial for preventing unauthorized access, especially in scenarios where changes to repository collaborators could indicate a supply chain compromise. The rule leverages the GitHub.Audit log type, examining actions such as `repo.add_member` for adding collaborators and `repo.remove_member` for removing them, ensuring that legitimate and unauthorized changes are effectively captured. Additionally, it includes test cases that validate each scenario, confirming that the detection logic is correctly applied. Users are advised to verify the authorization status of new collaborators against legitimate access controls as part of the established runbook procedures.
Categories
- Web
- Cloud
- Identity Management
Data Sources
- User Account
- Application Log
ATT&CK Techniques
- T1195
Created: 2022-09-02