GitHub Repo switched from private to public

Description

'This hunting query identifies GitHub activites where a repo was changed from private to public that may be a sign of compromise.'

Query · kql

GitHubAudit
| where Action == "repo.access"
| where OperationType == "MODIFY"
| where Visibility == "PUBLIC" 
| project TimeGenerated, Action, Actor, Country, Repository, Visibility
Raw source GitHub Repo switched from private to public · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a6e2afd3-559c-4e88-a693-39c1f6789ef1
name: GitHub Repo switched from private to public
description: |
  'This hunting query identifies GitHub activites where a repo was changed from private to public that may be a sign of compromise.'
requiredDataConnectors: []
tactics:
  - Collection
relevantTechniques:
  - T1213
query: |

  GitHubAudit
  | where Action == "repo.access"
  | where OperationType == "MODIFY"
  | where Visibility == "PUBLIC" 
  | project TimeGenerated, Action, Actor, Country, Repository, Visibility

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.