GitHub Audit Events: Repository Archived/Unarchived Status Change
Alerts on GitHub audit events indicating a repository was archived or unarchived.
FreeReviewedSigma · Low · v5
- Product
- github
- Service
- audit
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2025-10-18
- Updated
- 2026-07-31
What it detects
This rule flags GitHub audit events indicating a repository was archived or unarchived. Changes to repository availability can be used to disrupt development workflows or conceal activity, so status modifications are security-relevant. It relies on GitHub audit logs capturing the specific repository archival actions.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
- sentinelone.comhttps://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
- docs.github.comhttps://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repository_archive_status_changed.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
github-audit-logs-repository-archived-unarchived-status-change-dca8991c
title: "GitHub Audit Events: Repository Archived/Unarchived Status Change"
id: c104d154-e722-434d-89b9-692aeabe09ec
status: experimental
description: This rule flags GitHub audit events indicating a repository was archived or unarchived. Changes to repository availability can be used to disrupt development workflows or conceal activity, so status modifications are security-relevant. It relies on GitHub audit logs capturing the specific repository archival actions.
references:
- https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_repository_archive_status_changed.yml
author: Ivan Saakov, Huntrule Team
date: 2025-10-18
tags:
- attack.persistence
- attack.impact
- attack.defense-impairment
logsource:
product: github
service: audit
detection:
selection:
action:
- repo.archived
- repo.unarchived
condition: selection
falsepositives:
- Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.
level: low
license: DRL-1.1
related:
- id: dca8991c-cb16-4128-abf8-6b11e5cd156f
type: derived