GitHub Pages repository site changed to public (repo.pages_public audit event)
Flags when a GitHub repository’s Pages site visibility is changed to public in the audit log.
FreeReviewedSigma · Low · v5
- Product
- github
- Service
- audit
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2025-10-18
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit log activity where a repository’s GitHub Pages site is set to public. Making a Pages site public can be part of legitimate publishing, but it also increases the risk of unintended exposure of repository content. The detection relies on the GitHub audit event action indicating the Pages visibility change.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
- sentinelone.comhttps://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
- docs.github.comhttps://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_pages_site_changed_to_public.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
github-audit-log-repository-pages-changed-to-public-0c46d4f4
title: GitHub Pages repository site changed to public (repo.pages_public audit event)
id: 0e0679de-399c-4858-afbe-14fa2f2b155a
status: experimental
description: This rule flags GitHub audit log activity where a repository’s GitHub Pages site is set to public. Making a Pages site public can be part of legitimate publishing, but it also increases the risk of unintended exposure of repository content. The detection relies on the GitHub audit event action indicating the Pages visibility change.
references:
- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_pages_site_changed_to_public.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-18
tags:
- attack.collection
- attack.exfiltration
- attack.t1567.001
logsource:
product: github
service: audit
detection:
selection:
action: repo.pages_public
condition: selection
falsepositives:
- Legitimate publishing of repository pages by authorized users
level: low
license: DRL-1.1
related:
- id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55
type: derived