GitHub Audit Log: Repository Pages Changed to Public

title: "GitHub Audit Log: Repository Pages Changed to Public"
id: 0e0679de-399c-4858-afbe-14fa2f2b155a
status: experimental
description: "This rule matches GitHub audit events where a repository’s GitHub Pages site is set to public (action: repo.pages_public). Making Pages public can be part of routine publishing, but it can also expose repository content or generated site content to unauthorized viewers. The detection relies on GitHub audit log telemetry capturing the Pages visibility change action."
references:
  - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
  - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_pages_site_changed_to_public.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-18
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1567.001
logsource:
  product: github
  service: audit
detection:
  selection:
    action: repo.pages_public
  condition: selection
falsepositives:
  - Legitimate publishing of repository pages by authorized users
level: low
license: DRL-1.1
related:
  - id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55
    type: derived