GitHub Audit Logs: Codespaces and Repo Delete Actions

title: "GitHub Audit Logs: Codespaces and Repo Delete Actions"
id: ed2ebe27-098c-4d8e-a206-1b40abc97004
status: test
description: This rule flags GitHub audit log events where deletion actions occur for Codespaces, environments, projects, or repositories (codespaces.destroy, environment.delete, project.delete, repo.destroy). Deletions can indicate destructive impact such as removing resources or disrupting workflows, so monitoring them helps detect unauthorized or risky changes. It relies on GitHub product audit log records that capture the specific action names for these resource types.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-19
modified: 2026-03-09
references:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_delete_action_invoked.yml
tags:
  - attack.impact
  - attack.collection
  - attack.t1213.003
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - codespaces.destroy
      - environment.delete
      - project.delete
      - repo.destroy
  condition: selection
falsepositives:
  - Validate the deletion activity is permitted. The "actor" field need to be validated.
level: medium
license: DRL-1.1
related:
  - id: 16a71777-0b2e-4db7-9888-9d59cb75200b
    type: derived