GitHub - User was added to the organization

Status: available
Severity: medium
Time window: 7d
Source: github.com/Azure/Azure-Sentinel

Detect activities when a user was added to the organization. This query runs every day and its severity is Medium.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `org.add_member`: User joined organization

Rules detecting the same action

These rules filter on the same operation.

GitHub User Added or Removed from Org (Panther)
New Github Organization Member Added (Sigma)
New GitHub Owner Added (Elastic)
New User Added To GitHub Organization (Elastic)

Rule body

id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c4
name: GitHub - User was added to the organization
description: |
  'Detect activities when a user was added to the organization. This query runs every day and its severity is Medium.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
    GitHubAuditData
    | where Action == "org.add_member"
    | project Actor, Action
    | extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)
    | extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: Name
      - identifier: UPNSuffix
        columnName: UPNSuffix
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "org.add_member"

Stage 3: `project`

| project Actor, Action

Stage 4: `extend`

| extend Name = iif(Actor contains "@", split(Actor, "@")[0], Actor)

Stage 5: `extend`

| extend UPNSuffix = iif(Actor contains "@", split(Actor, "@")[1], "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`org.add_member`	`field:"Action" kind:eq value:"org.add_member"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`Actor`	`project`
`Name`	`extend`
`UPNSuffix`	`extend`