GitHub User Grants Access and Other User Grants Access

id: f18c4dfb-4fa6-4a9d-9bd3-f7569d1d685a
name: GitHub User Grants Access and Other User Grants Access
description: |
  'This hunting query identifies Accounts in GitHub that have granted access to another account which then grants access to yet another account that may be a sign of compromise.'
requiredDataConnectors: []
tactics:
  - Persistence
  - PrivilegeEscalation 
relevantTechniques:
  - T1098
  - T1078
query: |

  GitHubAudit
  | where ImpactedUser != ""
  | where Action == "org.invite_member" or Action == "org.add_member" or Action == "team.add_member" or Action == "repo.add_member"
  | distinct ImpactedUser, TimeGenerated, Actor
  | project-rename firstUserAdded = ImpactedUser, firstEventTime = TimeGenerated, firstAdderUser = Actor
  | join kind= innerunique (
    GitHubAudit
    | where ImpactedUser != ""
    | where Action == "org.invite_member" or Action == "org.add_member" or Action == "team.add_member" or Action == "repo.add_member"
    | distinct ImpactedUser, TimeGenerated, Actor
    | project-rename secondUserAdded = ImpactedUser, secondEventTime = TimeGenerated, secondAdderUser = Actor
  ) on $left.secondUserAdded == $right.firstUserAdded
  | where secondEventTime between (firstEventTime .. (firstEventTime + 1h))