Github Outside Collaborator Detected
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization…
Description
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detection logic
Detection requirements
- Platform
- IaaSIdentity ProviderOffice SuiteSaaS
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- github
- Log source service
- audit
Known benign triggers
- Validate the Multifactor Authentication changes.
- Validate the actor if permitted to access the repo.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions | 6 |
| docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- eaa9ac35-1730-441f-9587-25767bde99d7
- Tagged by the source as
- attack.collectionattack.persistenceattack.privilege-escalation
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1