GitHub Outgoing Organization Transfer Initiated
This rule detects when a GitHub organization initiates an outgoing transfer to another enterprise account. This activity is suspicious because an adversary might attempt to transfer a GitHub organization to an enterprise account they control to steal data, intellectual property, or maintain persistence. The rule specifically looks for the `org.transfer_outgoing` event type in GitHub audit logs.
YARA-L
