Detects when an account is added to a GitHub repository.

Overview

Priority	Low
Type	Stream
Log schema	github-audit
Message	GitHub 저장소 접근 권한 부여: 관리자 $user, 저장소 $repo, 대상 계정 $target_user, 권한 $permission
Output field order	_log_time, src_ip, actor, action, repo, user, permission, public_repo, user_agent, visibility
MITRE Techniques	T1098 Account Manipulation
MITRE tactics	TA0003 Persistence· TA0004 Privilege Escalation

Query

Extract GitHub repository member added events from GitHub audit logs in real-time.

Message

• GitHub repository member added: Actor $user, Repository $repo, Target User $target_user, Permission $permission

Field Order

• _log_time, src_ip, actor, action, repo, user, permission, public_repo, user_agent, visibility

Target logger models

• GitHub 감사 로그 github-audit

Threat analysis

• If an attacker compromises a GitHub administrator account, they may grant repository access to a malicious or attacker-controlled account while disguising it as a legitimate permission change. This is a common technique for establishing persistence and privilege escalation.
• Accounts with repository access—especially Write, Maintain, or Admin permissions—can read sensitive source code, modify files, manipulate workflows, or exfiltrate intellectual property, creating opportunities for supply chain attacks.
• Because repository permission grants can appear similar to normal administrative activity, detecting unauthorized privilege assignments can be challenging without monitoring.
• Insider threats may also misuse repository access assignments to bypass process controls, view sensitive code, or intentionally leak information.

False positives

• Administrators may legitimately grant access to new team members joining a project.
• Partner organizations or external vendors may receive temporary repository access as part of authorized collaboration.
• Service accounts or automation accounts for CI/CD systems may be granted access during pipeline setup.
• In environments where repository permissions are frequently adjusted, normal operational actions may trigger this detection.

Response actions

• Verify the Actor

  • Confirm whether the account ($user) that granted access is a legitimate administrator and whether the action was intentional.

• Review the Permission Level

  • Check whether $permission aligns with the principle of least privilege.
  • Investigate cases where unnecessary Write or Admin permissions were granted.

• Revoke Unauthorized Access

  • If the target account ($target_user) is unknown or suspicious, immediately remove the granted permissions.

• Analyze Account Activity

  • Review pull requests, commits, workflow runs, or other activities performed by the account before and after permission assignment.

• Check for Account Compromise

  • Analyze the administrator’s login history (IP address, User-Agent patterns) for signs of credential theft or session hijacking.

• Strengthen Security Controls

  • Introduce approval workflows for repository permission changes, minimize the number of administrators, and formalize external access policies.
  • Enable alerting or periodic auditing of repository permission changes.