GitHub: Unauthorized modification of private repository forking policy

This alert monitors for the enabling of private repository forking within a GitHub organization. Allowing forks of private repositories permits code to be copied out of the organization into personal forks, representing a high-risk collection path following an organization-owner compromise. This setting change is an indicator of potential data exfiltration.

Impact

Enabling private repository forking increases the risk of unauthorized source code exfiltration by allowing users with access to private repositories to fork them into personal accounts outside the organization's control.

Recommendation

• Review organization settings to ensure private repository forking is disabled unless explicitly required for inner-source development programs.
• Investigate the user.name and github.actor_ip associated with the policy change event private_repository_forking.enable.
• Audit for repository fork activity (repo.fork events) immediately following any detected policy change to identify if unauthorized copies were created.
• Transfer or delete any unauthorized forks identified during the investigation window.