GitHub Audit Logs: Repository Archived/Unarchived Status Change

title: "GitHub Audit Logs: Repository Archived/Unarchived Status Change"
id: c104d154-e722-434d-89b9-692aeabe09ec
status: experimental
description: This rule flags GitHub audit events where a repository is archived or unarchived. Attackers may use repository status changes to affect access and visibility as part of persistence or defense-impairment. It relies on GitHub audit log events that record repository archival status transitions.
references:
  - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
  - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repository_archive_status_changed.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-18
tags:
  - attack.persistence
  - attack.impact
  - attack.defense-impairment
logsource:
  product: github
  service: audit
detection:
  selection:
    action:
      - repo.archived
      - repo.unarchived
  condition: selection
falsepositives:
  - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.
level: low
license: DRL-1.1
related:
  - id: dca8991c-cb16-4128-abf8-6b11e5cd156f
    type: derived