GitHub Repository or Organization Transferred
Detects when a GitHub repository or an organization is transferred to another location. This activity can indicate an attempt to exfiltrate sensitive data, establish persistence in a new location, or disrupt operations by moving critical assets. The rule specifically monitors GitHub audit logs for actions such as 'migration.create' (creation of a migration file for data transfer), 'org.transfer_outgoing' or 'org.transfer' (transfer of an organization between enterprise accounts), and 'repo.transfer_outgoing' (transfer of a repository to another network).
Sigma
