GitHub Audit Log: Delete Actions for Codespaces, Environments, Projects, and Repositories
Alerts on GitHub audit log deletion actions for Codespaces, environments, projects, and repositories.
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-19
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit log events where delete-style actions occur for Codespaces, environments, projects, or repositories. Such activity matters because attackers may remove or disrupt resources to affect availability, hide activity, or reduce forensic evidence. Detection relies on GitHub audit log telemetry that records the specific action names (codespaces.destroy, environment.delete, project.delete, repo.destroy) associated with an actor.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- docs.github.comhttps://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_delete_action_invoked.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub Audit Log: Delete Actions for Codespaces, Environments, Projects, and Repositories"
id: ed2ebe27-098c-4d8e-a206-1b40abc97004
status: test
description: This rule flags GitHub audit log events where delete-style actions occur for Codespaces, environments, projects, or repositories. Such activity matters because attackers may remove or disrupt resources to affect availability, hide activity, or reduce forensic evidence. Detection relies on GitHub audit log telemetry that records the specific action names (codespaces.destroy, environment.delete, project.delete, repo.destroy) associated with an actor.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-19
modified: 2026-03-09
references:
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_delete_action_invoked.yml
tags:
- attack.impact
- attack.collection
- attack.t1213.003
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- codespaces.destroy
- environment.delete
- project.delete
- repo.destroy
condition: selection
falsepositives:
- Validate the deletion activity is permitted. The "actor" field need to be validated.
level: medium
license: DRL-1.1
related:
- id: 16a71777-0b2e-4db7-9888-9d59cb75200b
type: derived