GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled
Alerts on GitHub audit log events that create SSH certificate authorities or disable SSH certificate requirements.
- Product
- github
- Service
- audit
- Author
- Romain Gaillard (@romain-gaillard) (SigmaHQ), DRL 1.1
- Published
- 2024-07-29
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags GitHub organization-level changes to SSH certificate access by detecting events where an SSH certificate authority is created or where the requirement to use SSH certificates is disabled. Attackers may use these modifications to broaden SSH access, introduce new trust anchors, or reduce enforcement, enabling stealthy persistence or privileged access. It relies on GitHub audit log events capturing the specific action names for SSH certificate authority creation and SSH certificate requirement disablement.
Reporting behind it
- docs.github.comhttps://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
- docs.github.comhttps://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_ssh_certificate_config_changed.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled"
id: c3a0a1ff-6635-43c8-b1bd-9474a20b6b14
status: test
description: This rule flags GitHub organization-level changes to SSH certificate access by detecting events where an SSH certificate authority is created or where the requirement to use SSH certificates is disabled. Attackers may use these modifications to broaden SSH access, introduce new trust anchors, or reduce enforcement, enabling stealthy persistence or privileged access. It relies on GitHub audit log events capturing the specific action names for SSH certificate authority creation and SSH certificate requirement disablement.
references:
- https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_ssh_certificate_config_changed.yml
author: Romain Gaillard (@romain-gaillard), Huntrule Team
date: 2024-07-29
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1078.004
logsource:
product: github
service: audit
definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
selection:
action:
- ssh_certificate_authority.create
- ssh_certificate_requirement.disable
condition: selection
falsepositives:
- Allowed administrative activities.
level: medium
license: DRL-1.1
related:
- id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef
type: derived