GitHub Fork Private Repositories Setting Enabled/Cleared

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•4•0•45

Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.