Sunturai
Back to results
InformationalSplunk security contentPatrick Bareiss +1

GitHub Enterprise Remove Organization

The following analytic detects when a user removes an organization from GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for organization deletion events, which could indicate unauthorized…

Description

The following analytic detects when a user removes an organization from GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for organization deletion events, which could indicate unauthorized removal of critical business resources. For a SOC, identifying organization removals is crucial as it may signal account compromise, insider threats, or malicious attempts to disrupt business operations by deleting entire organizational structures. The impact could be severe, potentially resulting in loss of source code, repositories, team structures, access controls, and other critical organizational assets. This disruption could halt development workflows, cause data loss, and require significant effort to restore from backups if available. Additionally, unauthorized organization removal could be part of a larger attack campaign aimed at destroying or compromising enterprise assets.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
github_enterprise_audit_logs

Known benign triggers

  • No false positives have been identified at this time.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice