{"id":"16a71777-0b2e-4db7-9888-9d59cb75200b","title":"Github Delete Action Invoked","description":"Detects delete action in the Github audit logs for codespaces, environment, project and repo.","author":"Muhammad Faisal (@faisalusuf)","status":"test","level":"medium","date":"2023-01-19","modified":"2026-03-09","tags":["attack.impact","attack.collection","attack.t1213.003"],"technique_ids":["T1213.003"],"logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"falsepositives":["Validate the deletion activity is permitted. The \"actor\" field need to be validated."],"references":["https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions","https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces"],"source_path":"rules/application/github/audit/github_delete_action_invoked.yml","source_sha256":"4d6a6e7b727c42794e834b6052296ad2fcabc6fd405da2f3e273bf5fdd8a3308","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_delete_action_invoked.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Github Delete Action Invoked\nid: 16a71777-0b2e-4db7-9888-9d59cb75200b\nstatus: test\ndescription: Detects delete action in the Github audit logs for codespaces, environment, project and repo.\nauthor: Muhammad Faisal (@faisalusuf)\ndate: 2023-01-19\nmodified: 2026-03-09\nreferences:\n    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions\n    - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces\ntags:\n    - attack.impact\n    - attack.collection\n    - attack.t1213.003\nlogsource:\n    product: github\n    service: audit\n    definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'\ndetection:\n    selection:\n        action:\n            - 'codespaces.destroy'\n            - 'environment.delete'\n            - 'project.delete'\n            - 'repo.destroy'\n    condition: selection\nfalsepositives:\n    - Validate the deletion activity is permitted. The \"actor\" field need to be validated.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1213.003","id":"T1213.003","name":"Code Repositories","page":"techniques/enterprise/T1213.003/"}],"data_path":"data/detection-rules/16a71777-0b2e-4db7-9888-9d59cb75200b.json","kind":"sigma"}