GitHub Audit: High-Risk Security Controls Disabled
Alerts when GitHub audit logs show advanced security, OAuth restrictions, or 2FA requirements disabled for orgs or repos.
FreeReviewedSigma · High · v5
- Product
- github
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2023-01-29
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub audit events where an admin disables high-risk security features at the organization or repository level. Disabling controls like advanced security settings or OAuth/2FA restrictions can reduce account and credential protections and increase attacker persistence opportunities. It relies on GitHub audit log telemetry that records specific security-disabling actions in the matched event fields.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
- docs.github.comhttps://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
- docs.github.comhttps://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
- docs.github.comhttps://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_disable_high_risk_configuration.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
github-audit-organizational-high-risk-security-controls-disabled-8622c92d
title: "GitHub Audit: High-Risk Security Controls Disabled"
id: f6189a43-b3d8-4bca-b32b-14c67a593618
status: test
description: This rule flags GitHub audit events where an admin disables high-risk security features at the organization or repository level. Disabling controls like advanced security settings or OAuth/2FA restrictions can reduce account and credential protections and increase attacker persistence opportunities. It relies on GitHub audit log telemetry that records specific security-disabling actions in the matched event fields.
references:
- https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
- https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
- https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_disable_high_risk_configuration.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-29
modified: 2024-07-22
tags:
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1556
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- business_advanced_security.disabled_for_new_repos
- business_advanced_security.disabled_for_new_user_namespace_repos
- business_advanced_security.disabled
- business_advanced_security.user_namespace_repos_disabled
- org.advanced_security_disabled_for_new_repos
- org.advanced_security_disabled_on_all_repos
- org.advanced_security_policy_selected_member_disabled
- org.disable_oauth_app_restrictions
- org.disable_two_factor_requirement
- repo.advanced_security_disabled
condition: selection
falsepositives:
- Approved administrator/owner activities.
level: high
license: DRL-1.1
related:
- id: 8622c92d-c00e-463c-b09d-fd06166f6794
type: derived