Detectionmediumtest

Github Delete Action Invoked

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Muhammad FaisalCreated Thu Jan 1916a71777-0b2e-4db7-9888-9d59cb75200bapplication

Log Source

githubaudit

Productgithub← raw: github

Serviceaudit← raw: audit

Definition

Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming

Detection Logic

detection:
    selection:
        action:
            - 'codespaces.delete'
            - 'environment.delete'
            - 'project.delete'
            - 'repo.destroy'
    condition: selection

False Positives

Validate the deletion activity is permitted. The "actor" field need to be validated.

References

Resolving title…

docs.github.com

MITRE ATT&CK

Tactics

TA0040 · Impact TA0009 · Collection

Sub-techniques

T1213.003 · Code Repositories

Rule Metadata

Rule ID