GitHub audit: New Actions secret created for org, environment, repo, or Codespaces
Triggers on GitHub audit events when an actor creates a new Actions secret for org, environment, Codespaces, or repo.
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit log events where a user creates an Actions secret for an organization, an environment, a repository, or Codespaces. Creating secrets can enable attackers to persist access and use injected values in workflows, making the audit signal important for detecting stealthy configuration changes. It relies on GitHub audit log entries with specific action identifiers indicating secret creation.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_secret_created.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub audit: New Actions secret created for org, environment, repo, or Codespaces"
id: 32a4c8c1-5e9e-4132-be35-0fbe721b524e
status: test
description: This rule flags GitHub audit log events where a user creates an Actions secret for an organization, an environment, a repository, or Codespaces. Creating secrets can enable attackers to persist access and use injected values in workflows, making the audit signal important for detecting stealthy configuration changes. It relies on GitHub audit log entries with specific action identifiers indicating secret creation.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-20
references:
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_new_secret_created.yml
tags:
- attack.persistence
- attack.privilege-escalation
- attack.initial-access
- attack.stealth
- attack.t1078.004
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- codespaces.create_an_org_secret
- environment.create_actions_secret
- org.create_actions_secret
- repo.create_actions_secret
condition: selection
falsepositives:
- This detection cloud be noisy depending on the environment. It is recommended to keep a check on the new secrets when created and validate the "actor".
level: low
license: DRL-1.1
related:
- id: f9405037-bc97-4eb7-baba-167dad399b83
type: derived