GitHub setting changed to fork private repository

github-telemetry

Classification:

attack

Tactic:

TA0009-collection

Technique:

T1213-data-from-information-repositories

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detects policy changes to allow forking of private GitHub repositories.

Strategy

GitHub provides audit logs and webhook events that capture modifications to repository settings. Look for events where the fork setting for private repositories is enabled, which can pose a significant security risk by exposing sensitive code.

  • private_repository_forking.enable

Triage and Response

  1. Identify whether {{@github.actor}} is changing the forking policy for {{@github.repository}}.
  2. If the activity is suspicious:
    • Block the user in GitHub to prevent further access.
    • Begin your organization’s incident response process and investigate.