Possible GitHub Repository Archive Status Changed (via audit)

title: Possible GitHub Repository Archive Status Changed (via audit)
id: 47700f23-0425-5cfd-8e91-42dc2de5a091
status: stable
description: This rule detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
references:
    - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
    - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
    - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
author: Huntrule Team
date: 2026-04-01
tags:
    - attack.persistence
    - attack.impact
    - attack.defense-impairment
    - attack.t1485
logsource:
    product: github
    service: audit
detection:
    selection:
        action:
            - 'repo.archived'
            - 'repo.unarchived'
    condition: selection
falsepositives:
    - Unknown
level: low